DDoS — Distributed Denial of Service

Overwhelming a server/network with massive fake traffic so legitimate users can't reach it.

• DoS — one attacker, one machine.
• DDoS — thousands of machines (botnet) attacking simultaneously.

How It Works

Attacker
   │
   └── Controls Botnet (thousands of compromised devices)
         │
         ├── Device 1 ──┐
         ├── Device 2 ──┼──► Target Server
         ├── Device 3 ──┤
         └── ...        ┘

Victim server gets flooded → CPU/bandwidth exhausted → crashes or stops responding.

Types of DDoS

Type	Layer	How
Volumetric	L3/L4	Flood bandwidth (UDP flood, ICMP flood)
Protocol	L4	Exploit protocol weakness (SYN flood)
Application	L7	HTTP GET/POST flood, looks like real traffic

SYN Flood (Most Classic)

Attacker sends SYN → Server replies SYN-ACK → Attacker never sends ACK
Server keeps half-open connections until exhausted

Amplification Attack

• Attacker sends small request with spoofed victim IP.
• Server sends large response to victim.
• DNS/NTP used commonly for this.

Defense

Method	How It Helps
Rate limiting	Block IPs sending too many requests
Anycast diffusion	Spread traffic across many servers globally
CDN (Cloudflare)	Absorbs traffic before it hits origin
SYN cookies	Server doesn't allocate state until handshake completes
IP blacklisting	Block known botnet IPs
Traffic scrubbing	Filter malicious packets, pass clean traffic

Key Terms

• Botnet — network of compromised machines (zombies).
• Amplification factor — how much larger the response is vs request (DNS can be 50x).
• Scrubbing center — dedicated infrastructure that filters DDoS traffic.