What is DDoS?

DDoS (Distributed Denial of Service) is an attack aimed at making a service or website unavailable by overwhelming it with a huge number of requests from many sources.

In simple terms: thousands or millions of requests "pile onto" the server at once, and it stops responding to normal users.

---

#The essence of DDoS

Every server has limits:

• on network bandwidth;
• on the number of connections;
• on CPU and memory.

A DDoS attack exhausts these resources, so that:

• the site does not open;
• the service works very slowly;
• connections drop.

The main difference from DoS is that the attack comes from many devices at once.

---

#Why DDoS is called "Distributed"

Distributed means "spread out."

The attack comes:

• from a botnet (thousands of infected computers);
• from servers;
• sometimes from IoT devices (cameras, routers).

That is why the source of the attack is hard to trace and block.

---

#Main types of DDoS attacks

#1. Volume-based (L3/L4)

Goal: to clog the communication channel.

Examples:

• UDP flood;
• ICMP flood.

The network becomes overloaded.

---

#2. Protocol attacks (L3/L4)

Goal: to exhaust the resources of network devices.

Examples:

• SYN flood;
• Ping of Death.

The protocol stack becomes overloaded.

---

#3. Application (L7 DDoS)

Goal: to overload the application itself.

Examples:

• HTTP flood;
• mass requests to an API.

The hardest to detect, they look like ordinary users.

---

#What DDoS violates

• Availability, one of the key security principles.

Data is usually not stolen or altered, the service simply "goes down."

---

#How to defend against DDoS

#Main defense measures:

• rate limiting;
• firewall and traffic filtering;
• anti-DDoS services;
• CDN and load balancing;
• Anycast.

Serious DDoS attacks are usually defended against at the provider or cloud level.