--- id: CP-066 slug: ddos-distributed-denial-of-service lang: en title: Distributed denial of service (DDoS) description: How thousands of hijacked machines overwhelm a service, what employees notice on screen, and the organisation's reflexes. canonical_url: https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service/ markdown_url: https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Distributed denial of service (DDoS)", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service/ (CC BY 4.0) wing: 1 theme: understand_hacking reflex: cr-049 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service/ fr: https://startbrain.io/cyberpedia/fr/articles/attaque-ddos-deni-de-service-distribue/ de: https://startbrain.io/cyberpedia/de/articles/ddos-angriff-verteilte-dienstblockade/ es: https://startbrain.io/cyberpedia/es/articles/ataque-ddos-denegacion-de-servicio-distribuida/ sources: - "n": 1 title: Understanding Denial-of-Service Attacks publisher: CISA url: https://www.cisa.gov/news-events/news/understanding-denial-service-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 2 title: Network Denial of Service, Technique T1498 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1498/ accessed: "2026-11-03" - "n": 3 title: Denial of Service (DoS) guidance publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/denial-service-dos-guidance-collection accessed: "2026-11-03" - "n": 4 title: "Network Denial of Service: Direct Network Flood, Sub-technique T1498.001 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1498/001/ accessed: "2026-11-03" - "n": 5 title: "Network Denial of Service: Reflection Amplification, Sub-technique T1498.002 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1498/002/ accessed: "2026-11-03" - "n": 6 title: Endpoint Denial of Service, Technique T1499 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1499/ accessed: "2026-11-03" - "n": 7 title: "Endpoint Denial of Service: Service Exhaustion Flood, Sub-technique T1499.002 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1499/002/ accessed: "2026-11-03" - "n": 8 title: Heightened DDoS Threat Posed by Mirai and Other Botnets publisher: CISA url: https://www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and-other-botnets published: "2016-10-14" accessed: "2026-11-03" - "n": 9 title: "How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attack" publisher: Google url: https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack published: "2023-10-10" accessed: "2026-11-03" --- # Distributed denial of service (DDoS) A denial-of-service (DoS) attack prevents legitimate users from reaching a website, an email service, an online account or another service. The attacker floods the target with traffic until it can no longer respond or it crashes [1]. In its distributed form (DDoS), several machines act together against a single target [1]. For an employee, the result mostly shows up as slowness or a page that no longer opens. These signs can look like an availability problem with no malicious cause, but they can also point to a DoS or DDoS attack [1]. ## In 30 seconds - Where it happens: on websites, email services, online accounts and other services reachable over the Internet [1]. - What the attacker wants: to make the service unavailable, for political reasons, as a diversion or to extort money [2]. - The reflex: tell the network administrator, who checks whether the outage comes from maintenance or an internal incident, and who can monitor traffic to confirm an attack [1]. - If it has already happened: the administrator can contact the Internet service provider and apply firewall rules; the rest of the network still needs monitoring, because the attack is sometimes a diversion [1]. ## Straight answers ### What is a botnet? It is a group of connected devices hijacked by an attacker, who controls them with command-and-control software. The infected devices are themselves victims of the attack [1]. A botnet can be rented out to other people, often by "attack-for-hire" services that let unskilled users launch a DDoS [1]. ### Why is it harder to stop than an attack from a single machine? The traffic comes from many sources, which makes it harder to tell apart from legitimate traffic [3]. A DDoS also makes the real origin of the attack harder to identify [1]. In the worst cases, each machine sends only a small amount of traffic, and telling it apart from that of legitimate customers becomes extremely difficult [4]. ### How can you tell an attack from a simple outage? The symptoms look like those of an ordinary problem or of maintenance. CISA lists three signs that may point to an attack: an unusually slow network, a specific website that no longer responds, or being unable to open any website [1]. The best way to settle the question is network traffic monitoring [1]. ### Can you be affected without being targeted? Yes. If a network's Internet service provider or cloud provider is attacked, that network also loses its service [1]. ### Does a DDoS attack steal data? The sources consulted describe a loss of availability. The UK's NCSC notes that an unavailable public website can disrupt business (lost sales, employees who can no longer work), even with no effect on the confidentiality or integrity of data [3]. CISA, however, points out that attackers launch a DDoS to draw attention away and carry out secondary attacks against other services on the network [1]. ## Inside the attacker's head The attacker needs volume. He can build his own botnet or rent one for the time he uses it [4]. Connected objects, which often keep their default password, are vulnerable: the infection often goes unnoticed by their owner, and hundreds of thousands of devices can be compromised without the owner knowing [1]. He can also hide or forge the source address of the packets. This makes filtering by source address less effective, even useless, for defenders [2]. This article sorts attacks into three families, a presentation choice that does not reproduce a classification from the sources. The volumetric family saturates bandwidth. MITRE gives the example of 10 Gbit/s of traffic sent to a server connected to the Internet by a 1 Gbit/s link [2]. One variant uses third-party servers, the reflectors: the attacker sends them packets carrying the victim's forged address, and the replies, larger than the requests, go to the victim. DNS and NTP have allowed such amplification; the memcache protocol has shown amplification of up to 51,200 times the original packet [5]. The protocol family exploits how network exchanges work. In a SYN flood, the attacker requests a connection without completing the three-way handshake: the port stays occupied, and if the requests continue, all open ports are saturated [1]. MITRE recommends enabling SYN cookies as a defence [6]. The application family targets servers and applications. An HTTP flood sends a large number of requests to a web server to exhaust its resources [7]. An SSL/TLS renegotiation attack opens an encrypted connection and then chains renegotiation requests, which are costly in computing power [7]. These attacks exhaust the machine without saturating the network [6]. ## What you see on screen According to CISA, the symptoms can look like availability problems with no malicious cause, but they can point to a DoS or DDoS attack [1]. These symptoms are unusual slowness when opening files or websites, a specific website that cannot be reached, or no website that can be reached [1]. For a customer or a colleague, it is an error page or a service that does not respond. These signs can also come from maintenance or a technical incident [1]. The employee therefore does not have to make a diagnosis: they report what they notice. ## Under the hood On the network side, a direct flood mostly uses stateless protocols such as UDP or ICMP, but TCP can also be used [4]. Almost any network protocol will do [4]. On the server side, application attacks rely on bottlenecks specific to each layer: operating system, web server, DNS, database or application [6]. To defend, when the volume exceeds the capacity of the targeted connection, traffic must be filtered upstream, at the Internet service provider, in a content delivery network (CDN) or at a mitigation specialist [2]. Depending on the volume, filtering on site is sometimes possible: blocking the source addresses, ports or protocols being targeted [2]. ## Case files ### September 2016: Mirai against Brian Krebs's blog and OVH On 20 September 2016, Brian Krebs's security blog was hit by a massive attack, one of the largest on record, above 620 Gbit/s. It came from a botnet of connected objects controlled by the Mirai malware [8]. Mirai scans the Internet continuously for vulnerable devices, and tries a short list of 62 default usernames and passwords [8]. Mirai's alleged author claimed that more than 380,000 devices had been enslaved during the attack on Krebs's site [8]. At the end of September, another Mirai attack against the French host OVH set the record: at least 1.1 Tbit/s, possibly 1.5 Tbit/s [8]. The affected devices were mostly home routers, network cameras and digital video recorders [8]. Mirai's source code was published online at the end of September, which opened the way to other attacks [8]. At the end of November 2016, software derived from Mirai scanned TCP port 7547 on vulnerable broadband routers [8]. For an infected device, CISA recommends disconnecting it, rebooting it offline (Mirai lives in random-access memory), replacing the default password, and only then reconnecting it [8]. ### August 2023: the HTTP/2 "Rapid Reset" attack Google described a novel HTTP/2 DDoS attack on 10 October 2023, with a peak in August. The largest exceeded 398 million requests per second, well above any layer 7 attack reported before [9]. It was largely stopped at the edge of Google's network by its load-balancing infrastructure, with no outage [9]. The principle: the client opens many streams at once, then cancels each request immediately by sending an RST_STREAM frame, without waiting for the response [9]. The server nevertheless has to do significant work for the cancelled requests, while the client pays almost none of the cost [9]. Google coordinated the disclosure with industry partners and reserved the identifier CVE-2023-44487 to track the fixes [9]. It recommends applying patches as soon as possible [9]. ### Other dated cases In 2016, APT28 carried out a DDoS against the World Anti-Doping Agency [2]. In 2019, Sandworm Team temporarily disrupted Georgian websites after compromising a web hosting provider [6]. A series of incidents in 2012 targeted major US banks [4]. ## What the organisation does CISA states that nothing completely prevents being targeted. Administrators can subscribe to a protection service that detects abnormal flows and filters traffic, and prepare a disaster recovery plan [1]. The UK's NCSC lists four practices: know your service, know your defences, create a response plan and test it [3]. On the employee side, two actions: quickly report unusual slowness or unavailability to the network administrator, and change the default passwords of connected devices, including at home [1][8]. ## Sources 1. CISA, "Understanding Denial-of-Service Attacks", 1 February 2021. https://www.cisa.gov/news-events/news/understanding-denial-service-attacks (accessed 3 November 2026) 2. MITRE ATT&CK, "Network Denial of Service, Technique T1498 - Enterprise". https://attack.mitre.org/techniques/T1498/ (accessed 3 November 2026) 3. NCSC (UK), "Denial of Service (DoS) guidance". https://www.ncsc.gov.uk/collection/denial-service-dos-guidance-collection (accessed 3 November 2026) 4. MITRE ATT&CK, "Network Denial of Service: Direct Network Flood, Sub-technique T1498.001 - Enterprise". https://attack.mitre.org/techniques/T1498/001/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Network Denial of Service: Reflection Amplification, Sub-technique T1498.002 - Enterprise". https://attack.mitre.org/techniques/T1498/002/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Endpoint Denial of Service, Technique T1499 - Enterprise". https://attack.mitre.org/techniques/T1499/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Endpoint Denial of Service: Service Exhaustion Flood, Sub-technique T1499.002 - Enterprise". https://attack.mitre.org/techniques/T1499/002/ (accessed 3 November 2026) 8. CISA, "Heightened DDoS Threat Posed by Mirai and Other Botnets", 14 October 2016. https://www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and-other-botnets (accessed 3 November 2026) 9. Google, "How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attack", 10 October 2023. https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.