Cyberpediaby Brain
ENDEFR

Distributed denial of service (DDoS)

How thousands of hijacked machines overwhelm a service, what employees notice on screen, and the organisation's reflexes.

In 30 seconds

Where it happens
On websites, email services, online accounts and other services reachable over the Internet1.
What the attacker wants
To make the service unavailable, for political reasons, as a diversion or to extort money2.
The reflex
Tell the network administrator, who checks whether the outage comes from maintenance or an internal incident, and who can monitor traffic to confirm an attack1.
If it has already happened
The administrator can contact the Internet service provider and apply firewall rules; the rest of the network still needs monitoring, because the attack is sometimes a diversion1.

What it is

A denial-of-service (DoS) attack prevents legitimate users from reaching a website, an email service, an online account or another service. The attacker floods the target with traffic until it can no longer respond or it crashes1.

In its distributed form (DDoS), several machines act together against a single target1. For an employee, the result mostly shows up as slowness or a page that no longer opens. These signs can look like an availability problem with no malicious cause, but they can also point to a DoS or DDoS attack1.

Straight answers

What is a botnet?

It is a group of connected devices hijacked by an attacker, who controls them with command-and-control software. The infected devices are themselves victims of the attack1. A botnet can be rented out to other people, often by "attack-for-hire" services that let unskilled users launch a DDoS1.

Why is it harder to stop than an attack from a single machine?

The traffic comes from many sources, which makes it harder to tell apart from legitimate traffic3. A DDoS also makes the real origin of the attack harder to identify1. In the worst cases, each machine sends only a small amount of traffic, and telling it apart from that of legitimate customers becomes extremely difficult4.

How can you tell an attack from a simple outage?

The symptoms look like those of an ordinary problem or of maintenance. CISA lists three signs that may point to an attack: an unusually slow network, a specific website that no longer responds, or being unable to open any website1. The best way to settle the question is network traffic monitoring1.

Can you be affected without being targeted?

Yes. If a network's Internet service provider or cloud provider is attacked, that network also loses its service1.

Does a DDoS attack steal data?

The sources consulted describe a loss of availability. The UK's NCSC notes that an unavailable public website can disrupt business (lost sales, employees who can no longer work), even with no effect on the confidentiality or integrity of data3. CISA, however, points out that attackers launch a DDoS to draw attention away and carry out secondary attacks against other services on the network1.

1Inside the attacker's head2 min

The attacker needs volume. He can build his own botnet or rent one for the time he uses it4. Connected objects, which often keep their default password, are vulnerable: the infection often goes unnoticed by their owner, and hundreds of thousands of devices can be compromised without the owner knowing1.

He can also hide or forge the source address of the packets. This makes filtering by source address less effective, even useless, for defenders2.

This article sorts attacks into three families, a presentation choice that does not reproduce a classification from the sources.

The volumetric family saturates bandwidth. MITRE gives the example of 10 Gbit/s of traffic sent to a server connected to the Internet by a 1 Gbit/s link2. One variant uses third-party servers, the reflectors: the attacker sends them packets carrying the victim's forged address, and the replies, larger than the requests, go to the victim. DNS and NTP have allowed such amplification; the memcache protocol has shown amplification of up to 51,200 times the original packet5.

The protocol family exploits how network exchanges work. In a SYN flood, the attacker requests a connection without completing the three-way handshake: the port stays occupied, and if the requests continue, all open ports are saturated1. MITRE recommends enabling SYN cookies as a defence6.

The application family targets servers and applications. An HTTP flood sends a large number of requests to a web server to exhaust its resources7. An SSL/TLS renegotiation attack opens an encrypted connection and then chains renegotiation requests, which are costly in computing power7. These attacks exhaust the machine without saturating the network6.

2What you see on screen1 min

According to CISA, the symptoms can look like availability problems with no malicious cause, but they can point to a DoS or DDoS attack1. These symptoms are unusual slowness when opening files or websites, a specific website that cannot be reached, or no website that can be reached1. For a customer or a colleague, it is an error page or a service that does not respond.

These signs can also come from maintenance or a technical incident1. The employee therefore does not have to make a diagnosis: they report what they notice.

3Under the hoodIT teams1 min

On the network side, a direct flood mostly uses stateless protocols such as UDP or ICMP, but TCP can also be used4. Almost any network protocol will do4.

On the server side, application attacks rely on bottlenecks specific to each layer: operating system, web server, DNS, database or application6.

To defend, when the volume exceeds the capacity of the targeted connection, traffic must be filtered upstream, at the Internet service provider, in a content delivery network (CDN) or at a mitigation specialist2. Depending on the volume, filtering on site is sometimes possible: blocking the source addresses, ports or protocols being targeted2.

4Case filesReal cases2 min

September 2016: Mirai against Brian Krebs's blog and OVH

On 20 September 2016, Brian Krebs's security blog was hit by a massive attack, one of the largest on record, above 620 Gbit/s. It came from a botnet of connected objects controlled by the Mirai malware8. Mirai scans the Internet continuously for vulnerable devices, and tries a short list of 62 default usernames and passwords8. Mirai's alleged author claimed that more than 380,000 devices had been enslaved during the attack on Krebs's site8.

At the end of September, another Mirai attack against the French host OVH set the record: at least 1.1 Tbit/s, possibly 1.5 Tbit/s8. The affected devices were mostly home routers, network cameras and digital video recorders8. Mirai's source code was published online at the end of September, which opened the way to other attacks8. At the end of November 2016, software derived from Mirai scanned TCP port 7547 on vulnerable broadband routers8.

For an infected device, CISA recommends disconnecting it, rebooting it offline (Mirai lives in random-access memory), replacing the default password, and only then reconnecting it8.

August 2023: the HTTP/2 "Rapid Reset" attack

Google described a novel HTTP/2 DDoS attack on 10 October 2023, with a peak in August. The largest exceeded 398 million requests per second, well above any layer 7 attack reported before9. It was largely stopped at the edge of Google's network by its load-balancing infrastructure, with no outage9.

The principle: the client opens many streams at once, then cancels each request immediately by sending an RST_STREAM frame, without waiting for the response9. The server nevertheless has to do significant work for the cancelled requests, while the client pays almost none of the cost9. Google coordinated the disclosure with industry partners and reserved the identifier CVE-2023-44487 to track the fixes9. It recommends applying patches as soon as possible9.

Other dated cases

In 2016, APT28 carried out a DDoS against the World Anti-Doping Agency2. In 2019, Sandworm Team temporarily disrupted Georgian websites after compromising a web hosting provider6. A series of incidents in 2012 targeted major US banks4.

5What the organisation does1 min

CISA states that nothing completely prevents being targeted. Administrators can subscribe to a protection service that detects abnormal flows and filters traffic, and prepare a disaster recovery plan1. The UK's NCSC lists four practices: know your service, know your defences, create a response plan and test it3.

On the employee side, two actions: quickly report unusual slowness or unavailability to the network administrator, and change the default passwords of connected devices, including at home18.

Fact sheet

Identifier
CP-066
Wing
1. Attacks and techniques
Brain skill
Understanding Hacking Mechanics (understand_hacking)
Brain reflex
cr-049
Diagram
G1 · Attack vs Defense Chain
Languages
de, en, fr
Sources
9 sources checked on 3 November 2026
Sources9 sources
  1. CISA, “Understanding Denial-of-Service Attacks”, 1 February 2021. https://www.cisa.gov/news-events/news/understanding-denial-service-attacks (accessed 3 November 2026)
  2. MITRE ATT&CK, “Network Denial of Service, Technique T1498 - Enterprise”. https://attack.mitre.org/techniques/T1498/ (accessed 3 November 2026)
  3. NCSC (UK), “Denial of Service (DoS) guidance”. https://www.ncsc.gov.uk/collection/denial-service-dos-guidance-collection (accessed 3 November 2026)
  4. MITRE ATT&CK, “Network Denial of Service: Direct Network Flood, Sub-technique T1498.001 - Enterprise”. https://attack.mitre.org/techniques/T1498/001/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Network Denial of Service: Reflection Amplification, Sub-technique T1498.002 - Enterprise”. https://attack.mitre.org/techniques/T1498/002/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Endpoint Denial of Service, Technique T1499 - Enterprise”. https://attack.mitre.org/techniques/T1499/ (accessed 3 November 2026)
  7. MITRE ATT&CK, “Endpoint Denial of Service: Service Exhaustion Flood, Sub-technique T1499.002 - Enterprise”. https://attack.mitre.org/techniques/T1499/002/ (accessed 3 November 2026)
  8. CISA, “Heightened DDoS Threat Posed by Mirai and Other Botnets”, 14 October 2016. https://www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and-other-botnets (accessed 3 November 2026)
  9. Google, “How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attack”, 10 October 2023. https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack (accessed 3 November 2026)

Cite this article

Brain, “Distributed denial of service (DDoS)”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service/

BibTeX 
@misc{brain_cp066_en_2026,
  author = {Brain},
  title = {Distributed denial of service (DDoS)},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/ddos-distributed-denial-of-service/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence