What Is a DDoS Attack?
Last reviewed on August 23, 2026.
A DDoS attack — distributed denial-of-service — is an attempt to knock a website, game server, or online service offline by burying it in more traffic than it can handle. Nothing is stolen and nothing is broken into. The target simply stops being able to answer real users, because it is too busy answering the attacker.
The word distributed is the important part. A single machine flooding a server is easy to shut out: block that one address and the problem disappears. A distributed attack arrives from thousands of different machines scattered across the world at once, so there is no single address to block, and much of the traffic looks like ordinary visitors.
On this page
The simplest way to picture it
Imagine a small restaurant with ten tables and one phone line. Now imagine ten thousand people calling to book a table at the same second, every second. The phone works perfectly. The staff are doing their jobs. But no real customer can get through, because the line is permanently occupied.
That is a denial-of-service attack. The restaurant has not been robbed or vandalised — it has been made unreachable. And because the calls come from ten thousand different numbers rather than one, refusing a single caller achieves nothing.
How an attack is actually assembled
The traffic in a modern DDoS attack almost never comes from the attacker's own machines. It comes from a botnet: a large collection of internet-connected devices that have been infected with malware and can be commanded remotely, usually without their owners noticing anything at all.
- Infection. Malware spreads to poorly secured devices — home routers, IP cameras, DVRs, smart plugs, and unpatched servers. Devices shipped with default passwords are the classic entry point.
- Enrolment. Each infected device quietly connects to a command-and-control server and waits. It carries on working normally, which is why infections go unnoticed for months or years.
- Command. The operator names a target and a time. The instruction is a few bytes.
- Flood. Every device in the botnet begins sending requests to the target simultaneously. Individually each one is negligible; collectively they can exceed the target's total capacity within seconds.
Botnets built largely from consumer IoT devices have reached hundreds of thousands of nodes and generated attacks measured in terabits per second. The owner of an infected camera typically notices nothing worse than a slightly slower connection.
The uncomfortable implication: any internet-connected device you own with a default password — a router, a camera, a smart doorbell — is a potential participant. Changing default credentials and applying firmware updates is the single most effective thing an individual can do to shrink the global pool of attack capacity.
The three types of DDoS attack
Attacks are grouped by which part of the network stack they overwhelm. They defend very differently, which is why the distinction matters.
| Type | What it exhausts | Typical examples | Measured in |
|---|---|---|---|
| Volumetric | Raw bandwidth — the pipe into the network fills up before traffic ever reaches the server | UDP floods, ICMP floods, DNS and NTP amplification | Gigabits or terabits per second (Gbps / Tbps) |
| Protocol | Connection state on servers, firewalls, and load balancers | SYN flood, Ping of Death, Smurf attack, fragmented packet attacks | Packets per second (pps) |
| Application layer | The application's own CPU, memory, and database — the expensive work behind each request | HTTP floods, Slowloris, repeated hits on search or login endpoints | Requests per second (rps) |
Application-layer attacks are the hardest to stop and the cheapest to launch. A request that costs the attacker almost nothing to send might cost the target a database query, a template render, and a cache miss. A few thousand requests per second of that kind can take down a site that would happily absorb far larger volumetric traffic.
Amplification: how a small attacker hits hard
Amplification is the trick that lets a modest botnet generate an enormous flood. The attacker sends a small request to a public server — a DNS resolver, an NTP time server, a memcached instance — but forges the return address so it reads as the victim's. The server dutifully sends its much larger reply to the victim instead.
The ratio between the request and the reply is the amplification factor. DNS gives roughly 50×; NTP's old monlist command gave several hundred×; exposed memcached servers have produced factors in the tens of thousands. One gigabit of outbound attack traffic becomes tens or hundreds of gigabits arriving at the target, and the victim sees the flood coming from thousands of legitimate, innocent servers.
DoS vs. DDoS
- DoS (denial of service)
- The flood comes from one machine or a small handful. Easy to trace, easy to filter — block the source address and it is over. Mostly of historical interest now.
- DDoS (distributed denial of service)
- The flood comes from thousands of machines across many countries and networks, most of them innocent, infected third parties. There is no single source to block, defence has to happen at scale, and attribution is genuinely difficult because every source address is someone else's compromised device.
Why people do it
- Extortion. A short demonstration attack, followed by a demand for payment to prevent a longer one. This is the most common commercial motive.
- Competitive sabotage. Knocking a rival offline during a product launch, a sale, or a tournament.
- Gaming. Booting an opponent off a match or taking down a game server. An enormous share of all attacks by count, usually small and short.
- Hacktivism and politics. Attacks on government, media, or corporate sites to make a statement, often timed to news events.
- Smokescreen. A loud attack that occupies the security team while a quieter intrusion happens elsewhere.
- Booter services. Attacks are sold as a subscription product, advertised as "stress testing", for a few dollars an hour. This is what put attacks within reach of people with no technical skill at all — and what most arrests involve.
How services defend themselves
Defence is mostly about having more capacity than the attacker and being able to tell real users from fake ones quickly.
- Scrubbing centres. Traffic is routed through a provider with enormous spare capacity that filters the attack and forwards only clean traffic. This is the core of what Cloudflare, Akamai, and similar providers sell.
- Anycast distribution. The same IP address is announced from data centres worldwide, so an attack is split across dozens of locations instead of concentrating on one, and each absorbs a manageable slice.
- Rate limiting. Caps on how many requests a single client may make in a window — effective against crude floods, less so against a widely distributed botnet.
- Challenges. A JavaScript computation, a proof-of-work puzzle, or a CAPTCHA that a browser passes transparently and a simple attack script fails.
- Overprovisioning and autoscaling. Having headroom, and adding more automatically, so a flood is expensive rather than fatal.
- Blackholing. The last resort: the upstream provider drops all traffic to the targeted address. The attack stops, but so does legitimate access — the attacker has won, just cheaply for everyone else.
Is it illegal?
Yes, essentially everywhere. Launching a DDoS attack against a system you do not own or have written permission to test is a criminal offence in most jurisdictions — the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act in the United Kingdom, and comparable computer-crime statutes elsewhere. Sentences of several years are routine, and prosecutions regularly cover both operators of booter services and their customers, whose payment records are seized along with the service.
"I only paid for a stress-testing service" is not a defence, and neither is being a minor: a substantial share of prosecutions involve teenagers who bought an attack for a game. Legitimate load testing is done against your own infrastructure, with your provider notified in advance.
Watching attacks on a map
Live cyber attack maps — animated arcs flying between countries over a dark world map — are how most people first encounter this subject. They are genuinely useful for conveying scale, and worth reading with some scepticism.
Vendor maps such as Kaspersky Cybermap, Check Point ThreatCloud, Fortinet's Threat Map, and Digital Attack Map show real data, but only what that vendor's own sensors and customers observe, usually sampled and delayed. No public map shows "the internet, live", and none of them can see your particular machine. The country a bar chart attributes an attack to is only where the last network hop came from — normally an infected third party, not the attacker.
If what you want is the visual — for a presentation, a video, a conference screen, or a stream overlay — our live cyber attack map simulates the whole SOC wall display in your browser: attack arcs, an incident feed, protocol breakdowns, and source-country rankings, running fullscreen and never going quiet.
Frequently asked questions
What does DDoS stand for?
Distributed Denial of Service. "Denial of service" is the effect — legitimate users are denied access — and "distributed" means the traffic arrives from many machines at once rather than from a single source.
How long does a DDoS attack last?
Most are short. The large majority end within an hour, and a great many last under ten minutes — long enough to disrupt a game or make an extortion point. A minority run for days, usually in campaigns against a specific organisation, sometimes in repeated waves designed to exhaust the defenders.
Can a DDoS attack steal my data?
Not directly. A DDoS attack floods a service with traffic; it does not gain access to systems or read data. The caveat is that attacks are sometimes used as a distraction while a separate intrusion is attempted elsewhere, so a flood is treated as a security event rather than merely a capacity problem.
Can someone DDoS my home internet?
An individual connection can be flooded if the attacker knows its IP address, which is why it happens in online gaming. Your connection drops until the attack stops or your ISP filters it. Practical mitigations: do not share your IP address, use voice chat inside the game rather than peer-to-peer services that expose it, and contact your ISP — a changed IP address usually ends it immediately.
How big can a DDoS attack get?
The largest publicly reported attacks have exceeded several terabits per second, and application-layer records now run into the hundreds of millions of requests per second. For context, that is far more than the total normal traffic of most national news sites combined.
Is a DDoS attack illegal?
Yes, in essentially every jurisdiction. Launching one against a system you do not own or have written permission to test is a criminal offence under laws such as the Computer Fraud and Abuse Act in the United States and the Computer Misuse Act in the United Kingdom. Prosecutions routinely cover both the operators of booter services and their paying customers.
What is the difference between a DDoS attack and a hack?
A DDoS attack makes a service unavailable without entering it — the equivalent of blocking a shop's doorway. A hack, in the sense of a breach, involves gaining unauthorised access to a system to read, change, or steal what is inside. They are different goals, different techniques, and usually different attackers.
What is a botnet?
A network of internet-connected devices infected with malware that lets someone control them remotely, generally without the owners' knowledge. Botnets are used for DDoS attacks, spam, credential stuffing, and cryptocurrency mining. Poorly secured IoT devices — routers, cameras, DVRs — make up a large share of them.
Are the attacks on live threat maps real?
On vendor maps, the underlying events are real but sampled, delayed, and limited to that vendor's own visibility. On simulator pages, including ours, the attacks are generated in the browser for visualisation and are not real telemetry. Either way, no public map can tell you whether you personally are being attacked.
Related pages
See the live cyber attack map for the full-screen visualisation, the fake hacker terminal and sci-fi tech dashboard for the rest of the war-room aesthetic, and the password generator if this page has made you think about your own accounts.