What is a DDoS Attack? (and how to defend against one)

Your site is suddenly unreachable, your servers are pinned, and the traffic graph looks like a wall. But there's no marketing campaign, no viral moment — just a flood. You may be on the receiving end of a DDoS attack: someone deliberately overwhelming your service until it falls over.

What a DDoS attack is

A DDoS (Distributed Denial of Service) attack tries to make a service unavailable by flooding it with more traffic or requests than it can handle. The "distributed" part is key: the flood comes from many sources at once — often a botnet of thousands of compromised devices — which makes it hard to simply block one offender.

	DoS	DDoS
Source	One machine	Many (a botnet)
Hard to block?	Easier (block one IP)	Hard (thousands of IPs)
Scale	Limited	Can be enormous

The main types

DDoS attacks hit at different layers:

Type	What it floods	Example
Volumetric	Your bandwidth	A massive flood of junk packets
Protocol	Connection state	SYN floods exhausting connection tables
Application	Your app's resources	Hammering an expensive endpoint (Layer 7)

The trickiest is application-layer (Layer 7): instead of brute volume, it sends seemingly-legitimate requests to expensive endpoints (a search, a login), exhausting your app while looking almost like real users.

How to defend

No single thing stops a DDoS — defence is layered:

Use a CDN / edge network. This is the big one. A large edge network (built on anycast) absorbs and spreads attack traffic across many locations, so it never concentrates on your origin.
Dedicated DDoS protection. Providers detect attack patterns and scrub malicious traffic before it reaches you.
Rate limiting. Cap how many requests any client can make, blunting application-layer floods.
A WAF. Filters malicious request patterns at the HTTP layer.
Overprovision and autoscale. Headroom buys time; autoscaling absorbs some surges.
Hide your origin. If attackers can't find your real server IP (only the CDN), they can't bypass your protection.

The core strategy: don't try to out-muscle a DDoS at your origin — you'll lose. Put a large, distributed network (CDN/anycast) in front, so the flood is absorbed across the whole internet's worth of capacity rather than landing on your one server.

Telling a DDoS from a real spike

Sometimes "the site is overwhelmed" is just success (a launch, going viral) — not an attack. The response differs (scale up vs. mitigate), so it helps to look at the shape: a sudden flood from many unusual sources/regions hitting odd endpoints smells like DDoS; organic growth from normal referrers looks like a real spike. Either way, you first need to know it's happening — which is where monitoring comes in.

A monitoring angle

DDoS shows up as a sudden spike in errors, 503s, and latency. The faster you detect it, the faster you mitigate. Uptime and response-time monitoring from multiple locations tells you the instant your service starts buckling — and whether it's global (likely an attack/origin issue) or regional.

The bottom line

	In one line
What	Flooding a service from many sources until it fails.
Types	Volumetric, protocol, and application-layer (Layer 7).
Defence	Layered — CDN/anycast first, then rate limits, WAF, scaling.
Don't	Try to absorb it at your single origin.

A DDoS is a brute-force availability attack, and the winning move is to put a vast distributed network between it and your origin. Layer your defences, hide your origin, and monitor closely so you catch the flood the moment it starts.