Fundamentals DoS and DDoS
A Denial of Service attack, or DoS, makes a website or online service unavailable to real users. A Distributed Denial of Service attack, or DDoS, does the same job with traffic from thousands of devices at once. Attackers rarely steal data this way. Their goal is disruption.
The Crowded Shop Example
Imagine a small shop with one door. A hundred fake customers rush in and stand at the counter. They ask questions but never buy anything. Real shoppers cannot reach the counter and leave. A DoS attack creates the same jam on a server. The server spends all its energy on fake requests and has nothing left for real visitors.
DoS Versus DDoS
| Feature | DoS | DDoS |
|---|---|---|
| Source of traffic | One device | Thousands of devices |
| Ease of blocking | Simple, block one address | Hard, many sources |
| Typical power | Low to medium | Very high |
| Tracing the attacker | Easier | Difficult |
How a DDoS Attack Is Built
Attackers infect ordinary devices such as home routers, cameras, and computers with malware. Each infected device becomes a bot. A large group of bots forms a botnet. The attacker controls the botnet from a command server and sends one order to all bots together.
[Bot] [Bot] [Bot] [Bot] [Bot] [Bot]
\ \ | | / /
\ \ | | / /
+----+--+----+--+----+
|
v
+------------------+
| Target Server | <-- overloaded, real users blocked
+------------------+
^
|
[Real User] cannot get through
Main Attack Types
Volumetric Attacks
Volumetric attacks flood the network connection with huge amounts of data. The pipe to the server fills up and nothing else passes through.
Protocol Attacks
Protocol attacks abuse the rules that computers use to talk to each other. They exhaust server resources such as connection tables.
Application Layer Attacks
Application layer attacks send many requests that look like normal page visits. Each request forces the server to do real work, such as a database search.
Warning Signs
- A website loads very slowly or not at all
- Traffic jumps sharply from unusual locations
- Thousands of requests hit the same page in seconds
- Network equipment reports full capacity
- Services in the same data center slow down together
Defense Methods
- Use a content delivery network that spreads traffic across many servers worldwide.
- Apply rate limiting so one address cannot send unlimited requests.
- Deploy a web application firewall to filter suspicious requests.
- Subscribe to a traffic scrubbing service that cleans data before it reaches the server.
- Keep extra bandwidth and server capacity available for sudden spikes.
- Build a response plan with contact details for the internet provider.
Protecting Your Own Devices
Home users help stop botnets by changing default passwords on routers and cameras. Software updates close holes that malware uses. Turning off unused remote access features reduces the number of ways in. A clean device cannot join an attack on someone else.
Business Impact
An online store that goes offline loses sales every minute. A bank that cannot serve customers loses trust. Attackers sometimes demand money to stop the flood, and security teams advise against paying. Preparation costs less than recovery.
Example: Ticket Sale Day
A popular concert goes on sale at noon. Millions of fans visit the ticket site, and the server struggles even without an attack. Operators separate genuine crowd surges from DDoS floods by checking whether visitors behave like humans. Real fans browse pages and wait in a queue. Bots send thousands of identical requests per second. Queue systems and bot checks protect fair access for real buyers.
Key Points
- DoS uses one source, and DDoS uses thousands of infected devices.
- Botnets turn ordinary gadgets into attack tools.
- Three main types exist: volumetric, protocol, and application layer.
- Traffic filtering, rate limits, and spare capacity reduce the damage.