What Is a DDoS Attack? How It Works and How to Stop One

What a DDoS attack is

A DDoS (distributed denial of service) attack is an attempt to make a server, website or network unusable by flooding it with more traffic or requests than it can handle. Real visitors and players cannot get through because the connection, the server or the application is too busy dealing with junk.

The "distributed" part is what makes it hard to deal with. The traffic comes from thousands of different machines at once, so there is no single address you can block to make it stop.

How a DDoS attack works

Most attacks are launched from a botnet: a large group of hacked devices such as home routers, cameras and poorly secured servers, all controlled by one person. Their owners usually have no idea. Access to a botnet is rented out cheaply through so-called booter or stresser services, which is why attacks on game servers and small business sites are so common.

Many attacks also use reflection and amplification. The attacker sends small requests to public services such as DNS, NTP or memcached servers, with the source address forged to be the victim's IP. Those services send their much larger replies to the victim, so a small amount of attacker traffic turns into a far larger flood.

The three main types of DDoS attack

Volumetric attacks

Aim to fill the connection with traffic so nothing else fits. UDP floods and amplification attacks are the common examples. They are measured in bits per second and have to be stopped upstream, before they reach the link they are trying to fill.

Protocol attacks

Aim to exhaust the state tables in servers, firewalls and load balancers rather than the bandwidth. SYN floods, ACK floods and fragment attacks fall in this group. They are measured in packets per second.

Application-layer attacks

Look like normal use of a service: HTTP requests to a website, or server-browser queries to a game server. Each request is cheap to send but costly to answer, so a modest number of them can bring an application down.

Real attacks often mix several types at once. The DDoS attack examples guide goes through the common ones in detail.

Signs you are under attack

• A sudden spike in inbound traffic or packet rate with no matching rise in real users.
• A website, game server or VPN that becomes slow or unreachable while the server itself shows low CPU.
• Players reporting lag, rubber-banding or mass disconnects at the same moment.
• Large numbers of half-open TCP connections, or UDP traffic arriving on ports you do not use.
• Your host null-routing your IP, which takes it offline to protect the rest of their network.

DDoS attacks in gaming

Game servers are attacked more than almost anything else online. Rival server owners, banned players and people who simply want to win a match all use DDoS attacks, and a flood in the middle of a busy evening knocks every player off at once. Game traffic is mostly UDP, which has no handshake, so the server cannot easily tell a real player's packet from a forged one. That is why game servers need filtering that understands the game's protocol, not just a bandwidth limit.

How DDoS protection stops an attack

Good protection works in layers, because no single layer can deal with every type of attack:

• Absorb the volume. Always-on mitigation on the upstream network soaks up floods and amplification before they reach the link.
• Filter at the edge. Packets that do not belong, such as fragments, reflected replies and traffic to closed ports, are dropped before they reach the server.
• Validate what is left. TCP handshakes are proxied, and UDP traffic is checked against the protocol the service really speaks.

This is how Glitch Guard works on our network. Read more on the DDoS protection page.

Frequently Asked Questions

Next Steps

See how to prevent DDoS attacks for a practical checklist, or DDoS attack examples for the common attack types and how each is stopped.