What Is a DDoS Attack and How Can You Stop One?

A distributed denial-of-service (DDoS) attack attempts to make a website, application, server, or network unavailable by overwhelming it with traffic or requests from multiple sources. DDoS attacks can slow down services, prevent legitimate users from connecting, and disrupt business operations.

The best way to deal with a DDoS attack is to prepare before one happens. During an attack, organizations should work with their internet service provider (ISP), security provider, or IT team to identify and filter malicious traffic.

What does DDoS mean?

DDoS stands for distributed denial-of-service.

A DDoS attack is a type of denial-of-service (DoS) attack in which traffic or requests come from multiple systems at the same time. Attackers may use a botnet, which is a group of compromised internet-connected devices, to generate large amounts of traffic toward a target.

The goal is to consume resources such as network bandwidth, connections, memory, or processing capacity so legitimate users cannot access the service.

DDoS vs. DoS

A traditional DoS attack generally originates from one source, while a DDoS attack uses multiple sources.

Because DDoS traffic can come from many different systems, blocking a single IP address usually is not enough to stop the attack.

What happens during a DDoS attack?

The impact depends on the type and size of the attack and what the attacker is targeting.

For a website or online application, you may notice:

• Slow page loading
• Timeouts or connection errors
• Services becoming unavailable
• Unusually high amounts of network traffic
• Increased server or application resource usage
• Legitimate users being unable to access the service

DDoS attacks can target different parts of an organization's infrastructure, including network resources, connection or protocol resources, and applications.

How can you tell if you're experiencing a DDoS attack?

A sudden and unexplained increase in traffic can be a warning sign, particularly when it is accompanied by performance problems or service outages.

Some common signs include:

• A sharp increase in network traffic
• Large numbers of requests arriving in a short period
• Traffic patterns that differ significantly from normal activity
• Repeated requests targeting the same service or resource
• Website or application performance suddenly declining
• Legitimate users reporting that they cannot connect

Not every traffic spike is a DDoS attack. A legitimate event, such as a successful promotion or sudden increase in customers, can also create unusually high traffic. IT and security teams should analyze traffic patterns before determining the cause.

How long does a DDoS attack last?

There is no standard length for a DDoS attack. Some attacks are brief, while others can continue for hours or longer. Attackers may also use repeated bursts of traffic rather than one continuous flood.

The impact can often be reduced more quickly when an organization has DDoS protection, monitoring, an incident response plan, and an established relationship with its ISP or security provider. CISA and the FBI recommend planning for DDoS attacks before an incident occurs.

What are the most common types of DDoS attacks?

DDoS attacks can target different layers of network and application infrastructure. Three common categories are:

1. Volumetric attacks

Volumetric attacks attempt to overwhelm a target with a large amount of network traffic.

The goal is to consume available bandwidth or network resources so legitimate traffic cannot reach the intended service.

2. Protocol attacks

Protocol attacks target the systems and protocols responsible for establishing and maintaining network connections.

For example, a SYN flood can send large numbers of connection requests in an attempt to consume available connection resources.

3. Application-layer attacks

Application-layer attacks target a specific website or application rather than simply overwhelming the network with traffic.

These attacks can be difficult to identify because individual requests may look similar to legitimate user activity. An HTTP flood is one example of an application-layer DDoS attack.

How do you stop a DDoS attack?

There is no single solution that stops every DDoS attack. The right response depends on the type of attack, the systems being targeted, and the organization's infrastructure.

If you believe you are experiencing a DDoS attack, consider these steps.

1. Contact your ISP or security provider

Contact your ISP, hosting provider, or DDoS mitigation provider as soon as possible.

These providers may be able to identify abnormal traffic and redirect or filter malicious traffic before it reaches your network. Establishing this relationship before an attack occurs can make the response faster.

2. Notify your IT or security team

Make sure the appropriate people know about the incident.

Your IT or security team can help determine whether the problem is a DDoS attack, another type of outage, or a security incident that requires a different response.

3. Monitor traffic and systems

Review network and application logs to understand what is happening.

Look for unusual traffic volumes, repeated requests, changes in the source of traffic, and the services or resources being targeted. Monitoring can also help your security team distinguish malicious traffic from legitimate increases in demand.

4. Use traffic filtering and rate limiting

Depending on your infrastructure, traffic filtering and rate limiting can help reduce the impact of some attacks.

Rate limiting controls how frequently a user, client, or system can make requests to a service. It can be implemented at the network or application level.

For larger attacks, organizations may use specialized DDoS mitigation services that filter traffic before it reaches their infrastructure.

5. Use a web application firewall when appropriate

A web application firewall (WAF) can help protect web applications by inspecting and filtering HTTP traffic.

A WAF can be useful against certain application-layer attacks, but it is not a complete solution for every type of DDoS attack.

6. Follow your incident response plan

A DDoS response plan should identify:

• Who is responsible for responding
• Who to contact at your ISP or security provider
• Which systems are critical
• How to monitor the attack
• How to communicate with employees and customers
• How to maintain essential operations if services become unavailable

Planning ahead can significantly reduce confusion during an attack. CISA and the FBI specifically recommend continuity planning and establishing relationships with service providers before an incident.

Can you prevent a DDoS attack?

You cannot guarantee that a website or network will never be targeted by a DDoS attack. However, you can reduce the likelihood and impact by preparing in advance.

Consider:

• Keeping operating systems, applications, and security tools updated
• Monitoring normal traffic patterns
• Using appropriate network and application security controls
• Implementing rate limiting where appropriate
• Working with an ISP or DDoS mitigation provider
• Maintaining an incident response and business continuity plan
• Regularly reviewing and testing your response plan

Organizations should also secure internet-connected devices because compromised devices can become part of botnets used in DDoS attacks.

Should you report a DDoS attack?

If your organization experiences a DDoS attack, preserve relevant information such as traffic logs, timestamps, alerts, screenshots, and communications related to the incident.

In the United States, organizations can report cybercrime to the FBI's Internet Crime Complaint Center (IC3). The FBI recommends including detailed information about the DDoS incident in the complaint.

Can you trace a DDoS attack?

Tracing the source of a DDoS attack can be difficult because traffic may originate from many systems, including compromised devices and infrastructure in different locations.

For this reason, organizations generally focus first on mitigating the attack and restoring availability rather than attempting to identify every system generating malicious traffic.

DDoS attack FAQs

Is a DDoS attack a virus?

No. A DDoS attack is an attempt to make a service unavailable by overwhelming its resources. Attackers may use compromised devices or a botnet to generate the traffic, but the DDoS attack itself is not a virus.

Can a DDoS attack damage my computer?

A DDoS attack primarily targets availability. It can make a service or device difficult or impossible to access, but a DDoS attack is not necessarily designed to damage hardware or steal data.

However, a DDoS event can occur alongside other malicious activity, so security teams should investigate unexpected behavior rather than assuming every outage is only a DDoS attack.

Can you stop a DDoS attack yourself?

Small or limited attacks may be manageable with existing network security controls, but larger attacks often require help from an ISP, hosting provider, or specialized DDoS mitigation service.

What is the best way to protect against a DDoS attack?

The best approach is layered protection combined with preparation. Monitoring, traffic filtering, rate limiting, appropriate application security, DDoS mitigation services, and a documented response plan can all help reduce the impact of an attack.

The bottom line

A DDoS attack attempts to overwhelm a website, application, server, or network so legitimate users cannot access it. While you cannot always prevent an attack, you can prepare for one.

The most important steps are to understand your normal traffic, monitor for unusual activity, maintain appropriate security controls, establish relationships with your ISP or security provider, and have a response plan ready before an attack happens.