Cybersecurity glossary
What is Distributed Denial of Service (DDoS)?
Learn what Distributed Denial of Service (DDoS) is, how botnets deliver volumetric and application-layer floods from many sources, how it differs from single-source DoS, and how edge defenses help.
Definition
Distributed Denial of Service (DDoS) is a denial-of-service attack launched from many compromised or coordinated sources at once, overwhelming a target’s bandwidth, network gear, or application capacity so legitimate traffic cannot get through.
Why DDoS matters
A single noisy IP is easy to drop. Distributed Denial of Service (DDoS) multiplies that problem across thousands of sources—botnets, spoofed amplifiers, or rented clouds—so filtering by address fails and capacity becomes the defense. Victims face saturated links, overwhelmed firewalls, or L7 request storms that look almost real.
DDoS is a distributed form of DoS. Volumetric vectors target pipes and network gear; application-layer vectors drive resource exhaustion on origins that lack quotas (unrestricted resource consumption).
How DDoS campaigns work
Assemble distributed firepower
Compromise devices into a botnet, rent attack infrastructure, or abuse reflection/amplification services.
Recon the target surface
Identify public IPs, DNS names, CDN origins, and expensive API routes worth flooding.
Launch volumetric and/or L7 traffic
Flood bandwidth with packets or hammer HTTP/API endpoints from many concurrent sources.
Overwhelm shared choke points
Saturate edge bandwidth, state tables, or origin compute so legitimate sessions cannot complete.
Adapt when mitigated
Shift ports, protocols, or switch to slow techniques such as distributed [Slowloris](/glossary/slowloris)-style holds.
Sustain business impact
Outages continue until scrubbing, scaling, and application limits restore usable capacity.
Volumetric vs application-layer DDoS
Volumetric (L3/L4)
High Gbps/pps floods and amplification that exhaust links and network devices before the app runs.
State exhaustion
SYN floods and similar tricks fill connection tables on firewalls, load balancers, and servers.
Application layer (L7)
Many sources issue costly GETs/POSTs that drain workers, caches, and databases.
Multi-vector campaigns
Attackers combine pipe floods with L7 storms so one mitigation layer is never enough.
Prevention
| Practice | Detail |
|---|---|
| Absorb at the edge | Use CDN/anycast and DDoS scrubbing so volumetric traffic never saturates the origin pipe. |
| Hide and harden origins | Keep origin IPs private where possible; rate-limit and authenticate expensive application routes. |
| Detect distributed patterns | Watch for geo/IP diversity with correlated spikes in bandwidth, RPS, and error rates. |
| Plan dual defenses | Network mitigation for floods plus app budgets for L7—neither replaces the other. |
- Establish a DDoS playbook with contacts for ISP/CDN scrubbing activation.
- Baseline normal RPS, bandwidth, and geographic mix to spot distributed anomalies.
- Protect DNS and APIs as first-class targets, not only the marketing homepage.
- Combine WAF/bot controls for L7 with capacity for volumetric absorption.
- Ensure application rate limits and timeouts remain in place when edge filters miss traffic.
- Test failover and origin lockdown so mitigated traffic does not hairpin back unprotected.
- Distinguish single-host DoS bugs (ReDoS, zip bombs) from true multi-source DDoS in postmortems.
- Treat open recursive amplifiers and exposed management ports as [security misconfiguration](/glossary/security-misconfiguration) risk.
The practical takeaway
DDoS is denial of service from many places at once—volumetric pipe floods and distributed application-layer storms. Edge absorption plus origin resource controls beat either alone.
If you only ban individual IPs, a botnet will simply rotate to the next thousand.
Related security terms
Denial of Service (DoS)
The parent availability-attack category of which DDoS is the distributed form.
Slowloris
A low-and-slow application technique sometimes used within distributed campaigns.
Resource Exhaustion
What application-layer DDoS often causes inside the target’s workers and pools.
Unrestricted Resource Consumption
API-side missing quotas that make L7 floods cheaper and more damaging.
Frequently asked questions
What is DDoS in simple terms?
Many computers attack one service at the same time—flooding it with traffic or requests until real users cannot connect.
How is DDoS different from DoS?
DoS is any availability attack. DDoS specifically uses many distributed sources, which is harder to block with a single IP ban.
What is volumetric DDoS?
Attacks that saturate network bandwidth or packet-processing capacity (often L3/L4), measured in Gbps or packets per second.
What is application-layer DDoS?
L7 floods of HTTP/API requests that look somewhat legitimate but overwhelm app servers, databases, or caches.
Do botnets always mean DDoS?
Botnets are a common delivery system for DDoS, but not every botnet campaign is availability-focused.
Can a WAF alone stop DDoS?
WAFs help with some L7 patterns. Large volumetric attacks usually need upstream scrubbing, anycast, or CDN capacity beyond the origin.
Is Slowloris a DDoS?
Slowloris is a DoS technique. It becomes distributed when many clients hold connections open in parallel.
References
Explore authoritative guidance and frameworks related to distributed denial of service (ddos).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.