DDoS Attacks
Understand the impact, detection, and prevention of distributed denial-of-service attacks.
What is a DDoS Attack?
A Distributed Denial-of-Service (DDoS) attack is a coordinated effort to overwhelm a system—like a server, network, or website—by flooding it with traffic. It’s often executed using a network of compromised devices known as a botnet. The goal is to make the system unavailable to legitimate users.
Real-World Examples
Case Study: GitHub (2018)
GitHub faced a 1.3 Tbps DDoS attack, one of the largest in history, leveraging misconfigured memcached servers to amplify traffic.
- Attack Type: Amplification (memcached)
- Response: Routed through Akamai’s scrubbing centers
Case Study: Dyn DNS (2016)
A DDoS attack on Dyn, a DNS provider, disrupted access to Netflix, Twitter, Spotify, and more using the Mirai botnet—largely composed of insecure IoT devices.
Watch explainer video →How DDoS Attacks Work
DDoS attacks typically fall into three main types:
- Volumetric: Overwhelm bandwidth (e.g., UDP floods)
- Protocol: Exploit network layer resources (e.g., SYN floods)
- Application Layer: Target apps directly (e.g., slowloris)
Mitigation & Prevention
Modern mitigation strategies rely on early detection, rate limiting, and cloud-based filtering. Here are key defenses:
- Use a CDN like Cloudflare or Akamai with DDoS protection
- Enable rate limiting on your servers
- Monitor traffic and set up automated alerts
- Geo-block traffic if under attack