DDoS (Distributed Denial of Service)
Definition
Service-denial attack sourced from many hosts at once. Volumetric (saturate bandwidth), protocol (exhaust state on stateful boxes), or application-layer (exhaust application resources).
- Source
- Many hosts attacking simultaneously, often a botnet
- Volumetric type
- Saturates available network bandwidth
- Protocol type
- Exhausts connection state on stateful network devices
- Application-layer type
- Exhausts server-side application resources with valid-looking requests
- Goal
- Denies service availability rather than stealing data
Common questions
How does a DDoS attack differ from a simple DoS attack?+
A DoS attack originates from a single source and is comparatively easy to block by filtering that source. A DDoS attack is distributed across many hosts at once, often thousands, which makes source-based blocking ineffective and requires traffic-pattern-based mitigation instead.
Why is the volumetric, protocol, and application-layer distinction important for incident responders?+
Each category demands a different mitigation approach: volumetric attacks need upstream bandwidth scrubbing, protocol attacks need connection-state hardening on network devices, and application-layer attacks need request-level filtering, so misclassifying the attack type leads to an ineffective response.
Related terms
- ARP Poisoning
- Sending forged ARP replies on a LAN to bind an attacker's MAC to a victim's IP in other hosts' ARP caches, redirecting...
- CVE / KEV
- Common Vulnerabilities and Exposures (MITRE-assigned identifier per public flaw). Known Exploited Vulnerabilities catalogue (CISA), which lists CVEs proven to be actively exploited...
- MITM (Man-in-the-Middle)
- Any attack in which the adversary sits between two endpoints and reads or modifies traffic. ARP poisoning, rogue access points, BGP hijacks...
- OWASP Top 10
- Open Worldwide Application Security Project's ranking of the most common web application security risks, refreshed every 3 to 4 years. Current edition:...
- Packet Sniffing
- Capture of network traffic from a wired tap, a switch SPAN port, or a Wi-Fi monitor-mode radio. Passive sniffing reads; active sniffing...