Itnetic TechnologiesHow a DDoS attack works
Every server has limits: bandwidth, connections, CPU, memory. A DDoS attack deliberately exhausts one of those limits. The "distributed" part is what makes it hard to stop — the traffic comes from thousands or millions of different devices (a botnet), so you cannot simply block one address.
Botnets are built from compromised computers, cheap cloud servers, and increasingly from hijacked IoT devices such as cameras and routers. Attack capacity is rented by the hour on underground markets, which is why even small websites get hit: launching an attack costs the attacker a few dollars, while every hour of downtime costs you revenue and trust.
The three main types of DDoS attack
1. Volumetric attacks flood your connection with raw data — UDP floods, DNS amplification, NTP reflection. They are measured in gigabits per second and aim to saturate the network pipe before traffic even reaches your server.
2. Protocol attacks abuse weaknesses in network protocols to exhaust connection state — SYN floods, fragmented-packet attacks, ping of death. They are measured in packets per second and target firewalls and load balancers.
3. Application-layer (Layer 7) attacks send requests that look like legitimate visitors — loading pages, submitting forms, hitting search endpoints. They are measured in requests per second and are the hardest to detect, because each individual request is indistinguishable from a real user. A few thousand requests per second against an expensive endpoint (search, login, checkout) can take down a site that comfortably survives a much larger volumetric flood. Read more in What is a Layer 7 DDoS attack?.
| Attack type | OSI layer | Measured in | Typical examples |
|---|---|---|---|
| Volumetric | 3–4 | Gigabits per second | UDP flood, DNS amplification, NTP reflection |
| Protocol | 3–4 | Packets per second | SYN flood, fragmented packets |
| Application-layer | 7 | Requests per second | HTTP flood, Slowloris, credential stuffing |
Warning signs you are under attack
- The site becomes slow or unreachable with no deploy or infrastructure change.
- Traffic spikes far above normal, often from unusual countries or networks.
- A single endpoint (login, search, cart) receives abnormal request volume.
- Your origin server's CPU or connection count saturates while bandwidth looks normal — a classic Layer 7 signature.
How DDoS mitigation works
Modern protection sits between the internet and your origin server, usually as a reverse proxy you enable by changing DNS records. Clean traffic passes through; attack traffic is filtered at the edge before it can reach you. Volumetric floods are absorbed by large network backbones, protocol attacks are dropped at the network layer, and application-layer attacks are separated from real users with behavioral analysis and lightweight browser challenges.
The practical steps to take during an active attack are covered in How to stop a DDoS attack. If you want protection in place before it happens, Itnetic's DDoS protection goes live with two DNS record changes.