What is a DDoS attack?

Every service on the internet has a limit: network bandwidth, open connections, CPU, memory. A DDoS attack tries to push past that limit on purpose. If the server spends everything answering junk, nothing is left for the people who actually want to use it.

If you host a site, an API or a bot with a webhook, understanding the mechanism helps you tell an attack from a traffic spike or a bug, and know where the defense has to sit.

What does DDoS stand for?#

DDoS means Distributed Denial of Service. "Denial" because legitimate users are prevented from using the service. "Distributed" because the traffic does not come from one place: it comes from many machines at once.

That is what separates it from a plain DoS. In a DoS, a single source attacks and blocking its IP is enough. In a DDoS, blocking one IP changes almost nothing, because thousands of others keep sending. According to CISA (the US cybersecurity agency), the distribution makes the attack larger and harder to trace.

How does a DDoS attack work?#

Attackers rarely use their own machines. They control a botnet: a network of compromised devices, such as computers, routers and cameras, that obey a central command without their owners knowing. CISA notes that botnets are sometimes rented out as "attack-for-hire" services, which lowers the barrier to entry.

The flow is simple:

1. The attacker infects devices and builds the botnet.
2. They pick a target (an IP or a domain) and send the command.
3. Each device sends requests or packets to the target.
4. The target runs out of a resource (bandwidth, connections or CPU) and starts refusing or delaying every request, legitimate ones included.

Each device on its own looks like a normal client. The attack only shows up in the sum.

What are the types of DDoS attacks?#

The most common classification groups attacks by the resource they exhaust, which also maps to the network layer being hit.

Volumetric (layers 3 and 4)#

These try to fill the network link until nothing else gets through. The classic trick is reflection amplification: UDP does not validate the source IP, so the attacker forges the victim's address and sends small requests to public servers (DNS, NTP, Memcached). Those servers reply to the victim with much larger packets. CISA lists amplification factors of 28 to 54 for DNS, 556.9 for NTP and 10,000 to 51,000 for Memcached. In practice, a few megabits from the attacker turn into a flood of gigabits.

Protocol (layer 4)#

These abuse how a protocol works to exhaust the connection table of a server or network device. The best-known example is the SYN flood. A TCP connection starts with a SYN; the server reserves memory, replies with SYN-ACK and waits for the final ACK. In the attack, SYNs arrive in bursts, often with spoofed sources, and the ACK never comes. Connections stay "half-open" until the operating system's limit (the backlog) fills up, and real connections get rejected (RFC 4987).

Application (layer 7)#

These look like legitimate traffic. An HTTP flood sends thousands of valid requests to expensive routes, such as search, login or a heavy database query. Each request alone is normal; the damage comes from the volume and the cost of processing each one. It is the hardest type to tell from a real spike, because you have to look at behavior, not just volume.

How do you know you are under a DDoS attack?#

CISA lists three symptoms: a very slow network or site, one specific site being unavailable, or no site being reachable. But those also show up with maintenance, bugs or a post that went viral. To tell the causes apart, check:

• Traffic source: many different IPs hitting the same routes, with no link to real users.
• Shape of the spike: a sudden jump with no campaign or launch to explain it.
• Resources: CPU, open connections or bandwidth at the limit without a matching rise in users.
• Access logs: identical requests, a repeated User-Agent, a single route and no "human" browsing (no CSS, images or scripts loaded).

According to CISA, traffic monitoring through a firewall or an intrusion detection system is the most reliable way to confirm.

What should you do when an attack starts?#

There is no magic button, but this order helps:

1. Confirm whether it is an attack or maintenance by checking metrics and logs.
2. Contact whoever sits in front of your traffic: your hosting or network provider, who can apply filters, firewall rules or reroute traffic to a mitigation service.
3. Watch the rest of the system: a DDoS can be a smokescreen for another attack, such as intrusion attempts in parallel.
4. Record times and traffic samples, which help the provider and let you tune rules later.

Preventive measures (edge mitigation, WAF, rate limiting, caching) are covered in how to protect your site or bot from DDoS. A CDN and a reverse proxy in front of your application already absorb part of the problem. If your site went down and you do not yet know why, see why is my website down.

Is a DDoS the same as a hack?#

No. A break-in seeks access: stealing data, running code, taking over an account. A DDoS seeks unavailability and needs no flaw in your code to work. That is why the defense differs too: strong passwords and patched vulnerabilities do not stop a DDoS, and traffic mitigation does not stop a break-in. They are different layers.

How to do this on Square Cloud#

Defense against volumetric DDoS has to sit at the edge, where there is network capacity to absorb traffic before it reaches your application. On Square Cloud, every plan includes L3/L4/L7 DDoS protection and a WAF, on a network with an Anycast CDN of more than 200 points of presence (based on Cloudflare), HTTP/3 and up to 10 Gbps per server. Traffic is unlimited, with no charge for bandwidth or requests (fair use policy).

Your applications run in isolated containers, but edge protection does not replace care in your own code: limiting requests, setting timeouts and using cache are still your responsibility.

Details on the network, mitigation and limits are in network and DDoS protection.