> ## Content Index > Fetch the complete content index at: https://www.thecybersignal.com/llms.txt > Use this file to discover other available public pages before exploring further. # What Is a DDoS Attack? How It Works and How to Stop It - URL: https://www.thecybersignal.com/what-is-a-ddos-attack-and-how-does-it-work/ - Published: 2026-05-26T03:01:32.000Z - Updated: 2026-08-04T00:07:10.000Z - Description: A complete guide to DDoS attacks: how distributed denial-of-service attacks use botnets to overwhelm a target, the three attack types, the record-breaking 2026 incidents defining the hyper-volumetric era, and the defenses that absorb them. - Author: Nicholas Robert - Tags: Cybersecurity 101, Cyber Attacks Most cyberattacks try to break in quietly, stealing data or seizing control without being noticed. A DDoS attack does the opposite. It is loud, disruptive, and immediately obvious: its entire purpose is to knock a website or online service offline by overwhelming it with traffic. And in 2026 that traffic has reached staggering scale — Cloudflare blocked a record 31.4 Tbps flood late in 2025, the largest ever publicly recorded. DDoS stands for distributed denial-of-service, and these are among the most common disruptions on the internet. Cloudflare alone mitigated 47.1 million of them across 2025, a 121% jump over the year before. A single attack can take down a company’s website, freeze an online store at peak sales, or disrupt critical services for hours — without the attacker ever stealing a file. This guide is part of our wider explainer on the [types of cyberattacks](https://www.thecybersignal.com/types-of-cyberattacks-the-complete-guide/), and it covers what a DDoS attack is, how it differs from a basic DoS, how botnets power it, the three attack categories, the record-breaking incidents defining the hyper-volumetric era, and how to defend against it. ## What Is a DDoS Attack? A DDoS attack is an attempt to make a website, application, or network unavailable by flooding it with more traffic than it can handle. Every target has finite capacity — a limited amount of bandwidth, memory, and processing power. A distributed denial-of-service attack deliberately exhausts that capacity from many sources at once, so legitimate users can no longer get through. The result is a denial of service: the website times out, the app stops responding, the service goes dark. Crucially, the attacker does not need to breach the system or steal anything. Disruption itself is the goal. ## DoS vs DDoS: What Is the Difference? The two terms are closely related. A **denial-of-service (DoS)** attack comes from a single source — one computer or connection flooding the target. Because it has one origin, a DoS attack is relatively easy to block: identify the source and filter it out. A **distributed denial-of-service (DDoS)** attack comes from many sources at once — often thousands or millions of devices spread across the world, all flooding the target simultaneously. That is what makes DDoS far more dangerous. There is no single source to block, the combined traffic is enormous, and the malicious requests are mixed in with legitimate ones. Nearly every serious denial-of-service attack today is distributed. ## How a DDoS Attack Works The “distributed” part depends on a **botnet** — a network of internet-connected devices infected with [malware](https://www.thecybersignal.com/what-is-malware-types-how-it-spreads-and-how-to-remove-it/) and controlled remotely by an attacker. These can be computers, servers, routers, or poorly secured Internet of Things gadgets such as cameras, smart appliances, and streaming boxes. Their owners usually have no idea their device has been compromised. To launch the attack, the operator sends a single command through a command-and-control channel, and every infected device begins sending traffic to the target at the same moment. A botnet of thousands or millions of devices generates a flood far larger than any attacker could produce alone — and from so many different addresses that it is extremely hard to filter cleanly. | ● ANATOMY OF A DDoS ATTACKHow one command turns millions of hijacked devices into a single crushing flood. | | ----------------------------------------------------------------------------------------------------------------------------- | | 1 · THE BOTNETMalware quietly infects millions of routers, cameras, and smart-TV boxes. Owners never notice. | | ↓ | | 2 · COMMAND & CONTROLThe attacker sends one instruction to the entire botnet, naming the target and the moment to fire. | | ↓ | | 3 · THE SYNCHRONIZED FLOODEvery device hits the same target at once from thousands of addresses — no single source to block. | | ↓ | | 4 · TARGET OVERWHELMEDBandwidth and server capacity are exhausted. The service goes dark and legitimate users are locked out. | | A botnet fans thousands of sources into one target — the “distributed” in distributed denial-of-service. | ## The Three Types of DDoS Attacks DDoS attacks are grouped into three categories based on which part of the target they overwhelm. Sophisticated attackers often combine all three in a single multi-vector campaign, forcing defenders to counter several techniques at once. | Category | What it exhausts | Measured in | Common vectors | | ---------------------- | --------------------------------------------- | ---------------------------- | ----------------------------------- | | Volumetric | The target’s raw network bandwidth | Bits per second (bps / Tbps) | UDP floods, DNS & NTP amplification | | Protocol | Server, firewall & load-balancer state tables | Packets per second (pps) | SYN floods, Ping of Death, Smurf | | Application-layer (L7) | The application and web server itself | Requests per second (rps) | HTTP floods, slow-rate attacks | In short: **volumetric attacks** clog the pipe with sheer data volume and are the most common type; **protocol attacks** exploit weaknesses in how network protocols work to exhaust the state tables of servers and equipment such as firewalls and load balancers; and **application-layer attacks** target the app itself with requests that each look legitimate but force expensive work, which makes them low-volume and hard to detect. ## Record-Breaking DDoS Attacks in 2026 The last year marked the arrival of the “hyper-volumetric” era, in which the biggest attacks are measured in tens of terabits per second. In late 2025 Cloudflare mitigated a **31.4 Tbps** flood — the largest ever publicly disclosed — that lasted just 35 seconds. It was the work of the **Aisuru/Kimwolf botnet**, assembled from more than two million compromised devices, most of them off-brand Android TV boxes and other insecure IoT hardware. A follow-on campaign that Cloudflare nicknamed “The Night Before Christmas” peaked at 205 million requests per second at the application layer. These records are an evolution of the Mirai-style IoT botnets that have dominated DDoS since 2016, and Cloudflare reported a 40% quarter-on-quarter rise in hyper-volumetric attacks at the end of 2025\. The threat is not only about scale, either: a 2026 Krebs on Security investigation found that a Brazilian anti-DDoS firm was itself [enabling a Mirai-based botnet that attacked other ISPs](https://www.thecybersignal.com/huge-networks-ddos-botnet-brazilian-isps-krebs-2026/), showing how the line between mitigation and abuse can blur. Attacks on [critical infrastructure](https://www.thecybersignal.com/the-importance-of-critical-infrastructure-security/) and public services have grown in parallel. ## Why Attackers Launch DDoS Attacks DDoS serves a range of motives. Some attacks are financially driven: the operator demands a ransom to stop, or to not launch, an attack — a tactic known as ransom DDoS. Some are competitive sabotage aimed at a rival’s site. Others are ideological, with hacktivists using disruption as protest. DDoS is also used as a distraction, generating chaos and tying up the security team while a more serious intrusion happens elsewhere. And because attack tools and “booter” or “stresser” services can be rented cheaply online, some attacks are simply vandalism. The range of [threat actors](https://www.thecybersignal.com/types-of-threat-actors-from-cybercriminals-to-nation-states/) runs from bored teenagers to nation-states. ## How to Detect a DDoS Attack A DDoS attack often looks, at first, like an ordinary technical problem. Warning signs include a site or service becoming suddenly slow or completely unavailable, a dramatic and unexplained spike in traffic, a flood of requests from a particular set of addresses or regions, and connectivity problems that do not trace back to an internal fault. Because these symptoms can resemble a legitimate traffic surge, monitoring tools that establish a normal baseline are essential for telling a real attack from a busy day. ## How to Mitigate and Prevent DDoS Attacks No organization can stop attackers from launching a DDoS attack, but it can prepare to absorb one. Effective defenses layer several controls: - **DDoS scrubbing and protection services.** Specialized providers route incoming traffic through scrubbing centers that filter out malicious packets and forward only clean traffic to the origin. - **A CDN with a Web Application Firewall (WAF).** A content delivery network absorbs and caches traffic across global infrastructure, while a WAF inspects requests to block application-layer floods before they reach the server. - **Anycast network distribution.** Anycast advertises one IP address from many data centers at once, spreading a single attack across a wide surface so no individual location is overwhelmed. - **Rate limiting.** Capping how many requests any single source can make in a window blunts application-layer attacks and slows abusive clients. - **Excess capacity and network hardening.** Provisioning scalable, cloud-based bandwidth raises the threshold an attack must exceed, while correctly configured firewalls and load balancers remove single points of failure. - **A tested response plan.** A prepared playbook — who to contact, how to activate mitigation, how to communicate with users — turns an outage into a managed event. The encouraging news is that DDoS is one of the most defensible attack types. An organization cannot prevent an attack from being launched, but with scrubbing services, a CDN and WAF, anycast distribution, vigilant monitoring, and a clear response plan, it can absorb even large attacks with little or no disruption. National agencies including [CISA](https://www.cisa.gov/news-events/news/understanding-and-responding-distributed-denial-service-attacks?ref=thecybersignal.com) publish guidance for organizations building that resilience. ## Frequently Asked Questions ### What is a DDoS attack? A DDoS (distributed denial-of-service) attack is an attempt to make a website or online service unavailable by flooding it with more traffic than it can handle, using many compromised devices at once. ### What is the difference between DoS and DDoS? A DoS attack floods a target from a single source, which makes it relatively easy to block. A DDoS attack floods the target from many sources simultaneously, making it far larger and much harder to filter. ### What is a botnet? A botnet is a network of internet-connected devices infected with malware and controlled remotely by an attacker. Botnets provide the many distributed sources of traffic that power a DDoS attack. ### Does a DDoS attack steal data? No. A DDoS attack disrupts availability rather than stealing information. However, attackers sometimes use a DDoS attack as a distraction to draw attention away from a separate data-stealing intrusion. ### How long does a DDoS attack last? DDoS attacks can last anywhere from a few seconds to several days. Duration depends on the attacker’s resources and motives and on how quickly the target activates mitigation. ### How can DDoS attacks be prevented? While the launch of an attack cannot be prevented, its impact can be minimized with DDoS scrubbing services, a CDN and WAF, anycast distribution, traffic monitoring, rate limiting, network hardening, and a tested response plan. ## Further Reading - [CISA — Understanding and Responding to Distributed Denial-of-Service Attacks](https://www.cisa.gov/news-events/news/understanding-and-responding-distributed-denial-service-attacks?ref=thecybersignal.com) - [Cloudflare — What is a DDoS attack?](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/?ref=thecybersignal.com) - [Cloudflare Radar — DDoS Threat Report for 2025 Q4](https://radar.cloudflare.com/reports/ddos-2025-q4?ref=thecybersignal.com) - [The CyberSignal — Types of Cyberattacks: The Complete Guide](https://www.thecybersignal.com/types-of-cyberattacks-the-complete-guide/) - [The CyberSignal — Most Common Cybersecurity Threats in 2026](https://www.thecybersignal.com/most-common-cybersecurity-threats-for-organizations-in-2026/)