What Is a DDoS Attack? Common Types and How to Defend

A DDoS (Distributed Denial of Service) attack uses many controlled devices to flood a target with requests or packets at once, exhausting its bandwidth, connections or processing capacity so real users cannot get through — like a crowd jamming a doorway shut.

How a DDoS attack works

Attackers compromise many machines and IoT devices via malware and vulnerabilities, forming a "botnet." On command, all of them send traffic at the target simultaneously. Because the sources are highly distributed and the volume is massive, an origin alone can rarely withstand it — hence "distributed."

Common types of DDoS

1. Bandwidth exhaustion (network layer)

• UDP flood: blasts huge volumes of UDP packets to saturate bandwidth.
• SYN flood: abuses the TCP three-way handshake, sending many half-open connections to exhaust the connection table.
• Reflection amplification: spoofs the source IP and sends small requests to DNS, NTP, Memcached, etc., making them blast multiplied responses at the victim — amplified tens to thousands of times.

2. Application layer (resource exhaustion)

• HTTP flood / CC: mimics real browsers to repeatedly hit expensive pages or endpoints, wearing down the web server and database. Stealthier — see What is a CC attack.

The damage

The service goes offline, costing orders and reputation; attacks often come with extortion; and if you absorb it on self-hosted bandwidth, traffic bills can spike instantly. For games, e-commerce and finance, a single large attack can cause serious losses.

How to defend against DDoS

• Scrubbing / high-defense: route traffic through a datacenter-grade scrubbing center first, filtering attack packets before reaching origin. The most effective measure against large floods.
• High-defense CDN: scrub and accelerate at edge nodes while hiding the origin — ideal for websites. See What is a high-defense CDN.
• Origin hiding + allowlist: never expose the real IP; the origin firewall allows only node back-to-origin IPs, closing the "bypass nodes" path.
• Rate and connection limits: throttle abnormal sources to mitigate small-to-medium attacks.
• Redundancy and failover: multiple lines/nodes, switching to high-defense lines under huge attacks to stay online.

What if a small site is hit by DDoS?

First, don't absorb it on the origin — onboard the domain to a high-defense CDN so the attack stops at the edge. Second, confirm the origin IP has not leaked and the firewall allows only back-to-origin traffic. Third, keep logs for review. CDN Doctor onboards in 5 minutes: change DNS and acceleration plus high-defense protection turn on automatically, with 24/7 standby.