What Is a DDoS Attack?

A DDoS attack — distributed denial of service — attempts to make a service unavailable by overwhelming it with traffic from many sources at once. The "distributed" is what gives the attack its force and its resilience: requests arrive from thousands or millions of devices, typically a botnet of compromised machines and IoT hardware, so no single source can be blocked to stop it. The goals range from extortion and sabotage to ideology and diversion — a loud attack on one front while something quieter happens on another — and rented "booter" services have made launching one cheap enough to require no skill at all.

The Layers of the Attack

DDoS attacks split by what they exhaust. Volumetric attacks saturate bandwidth with raw traffic floods, often amplified by reflection techniques that trick misconfigured servers into multiplying the attacker's output. Protocol attacks target the plumbing — half-open connection floods and similar tricks that fill state tables in servers and firewalls. Application-layer (Layer 7) attacks are the subtle tier: seemingly legitimate HTTP requests aimed at expensive operations — search queries, login attempts, cart operations — where a comparatively small request rate translates into heavy backend load. Layer 7 is where DDoS overlaps the bot problem, because each request looks like ordinary bot traffic or even human browsing, and blunt filters cannot separate attack from customer.

Weathering the Flood

Volumetric and protocol attacks are fought with infrastructure: anycast networks and scrubbing services that absorb and filter traffic upstream, deployed by CDN and mitigation providers at scales no single origin matches. Application-layer attacks demand finer instruments, because the defense must discriminate rather than absorb. Rate limiting caps what any session may cost; a WAF filters known-hostile patterns; and the expensive endpoints themselves can demand proof that a requester is worth serving. This is where verification earns a place in the stack: challenges based on proof of work force every client to spend computation before the server spends anything, inverting the attack's economics, and bot verification such as CaptchaFox helps keep botnet-driven request floods away from costly operations like search and login while genuine visitors pass invisibly. None of these layers replaces the others — resilience comes from the stack.

Preparing Before It Happens

DDoS response fails when improvised, so the work is front-loaded: know normal traffic well enough to recognize abnormal early, keep the mitigation path — provider contacts, failover, traffic diversion — rehearsed rather than theoretical, and deny attackers the cheap wins by protecting expensive endpoints as a matter of architecture. Availability is the least forgiving security property; the time to design for the flood is before the water arrives.