Types of DDoS Attacks Explained: Volumetric, Protocol, and Application Layer

DDoS attacks are not all alike -- some flood bandwidth, some exhaust connection tables, and some mimic real users. Here is how each type actually works.

DoS vs. DDoS: what is the difference

A DoS (Denial of Service) attack comes from a single attacking point sending excessive requests to overwhelm a target server. A DDoS (Distributed Denial of Service) attack adds "distributed" to that: a botnet of many devices infected with malware, sometimes hundreds of thousands, controlled remotely by an attacker, all hit the same target at once. Because the traffic originates from countless different IP addresses, simply blocking one IP does not stop it, which is what makes DDoS far harder to defend against.

Volumetric attacks: exhausting bandwidth itself

Volumetric attacks win through sheer traffic volume rather than sophistication. A UDP flood, which blasts meaningless UDP packets in bulk, is a classic example, and amplification attacks are also widely used — sending a small spoofed request to a server that responds to the target's IP with a much bigger reply, such as DNS or NTP servers. Measured in gigabits per second (Gbps), these attacks saturate the link to the target so there is no room left for legitimate traffic.

Protocol attacks: exhausting connection-state resources

These attacks exploit weaknesses in how a firewall, load balancer, or server manages connection state, with the SYN flood as the classic example. Since TCP connections start with a three-step SYN, SYN/ACK, ACK handshake, a SYN flood sends a flood of SYN requests and never sends the final ACK, forcing the target to keep piling up half-open connections until its connection table is exhausted. Other attacks that confuse firewalls or load balancers with crafted packets fall into this category too. Measured in packets per second (pps), protocol attacks target the processing capacity of network equipment along the path rather than raw bandwidth.

Application-layer attacks: disguised as normal traffic

These attacks put strain on a web server or specific feature using requests that are nearly indistinguishable from real users. An HTTP flood sends a large volume of seemingly ordinary web requests (GET/POST) at high speed to strain the server or database, while Slowloris does the opposite -- sending HTTP requests extremely slowly, piece by piece, to hold connections open and exhaust the server's concurrent-connection limit. Because the traffic volume is low and behaves like real users, these are harder to detect and block than the other two types. Measured in requests per second (rps), they target the web application or server software itself rather than the network link.

How botnets and amplification attacks work

A botnet is a network of devices -- PCs, IoT devices, and more -- infected with malware without their owners' knowledge, taking commands from an attacker. In an amplification attack, an attacker sends a small query to a reflector, such as an open DNS or NTP server, with the victim's IP address spoofed as the sender; the server then sends a much larger response to that spoofed address, meaning the real victim. This lets an attacker unleash traffic on a victim many times, sometimes dozens of times, larger than the bandwidth they actually used.

What businesses and individuals can do to defend against it

For an organization running a service, standard defenses include distributing traffic geographically with a CDN, filtering abnormal request patterns with a WAF (web application firewall), and rate-limiting requests. For extremely large attacks, an internet service provider (ISP) may use blackhole routing to discard the traffic entirely before it arrives. Home users are rarely a direct DDoS target themselves, but a realistic precaution is changing default passwords and keeping firmware updated on routers and IoT devices, so they do not unknowingly become part of a botnet.

Why DDoS is so hard to block with a simple IP ban

A single-source attack can often be stopped by blocking the offending IP address. A DDoS attack, by contrast, arrives from thousands or millions of distinct IPs at once, many of them ordinary home devices whose owners have no idea they are infected. Blocking each IP individually does not scale, which is why real DDoS defense relies on traffic-pattern analysis, rate limiting, and large-scale distribution rather than blacklists alone.

Why attackers combine multiple attack types

Real-world DDoS attacks often blend volumetric, protocol, and application-layer techniques in a single campaign, sometimes shifting from one type to another mid-attack once a defense kicks in for the first wave. This layered approach is part of why dedicated DDoS mitigation services, rather than a single firewall rule, have become standard for services that expect to be targeted.

Frequently Asked Questions

Can a small website actually become a DDoS target?

Yes -- targets are not limited to large companies. Small businesses, personal blogs, and online stores can all be targeted, whether for extortion, competitive sabotage, or no clear reason at all, which is why even smaller sites increasingly use CDN or WAF services with basic DDoS protection built in.

Is there anything an ordinary person can do to help prevent DDoS attacks?

While you are unlikely to be a direct target, keeping your router and any internet-connected devices updated and off default passwords helps prevent them from being silently recruited into a botnet used to attack others.