--- title: What is a DDoS Attack? (and how to defend against one) description: A DDoS attack drowns your service in traffic from thousands of sources until it buckles. Here's how these attacks work, the main types, and the practical layers of defence. canonical: https://watchfor.io/blog/what-is-a-ddos-attack --- [All posts](/blog) [Security](/blog/category/security) Dec 18, 2025 · 3 min read · WatchFor Team # What is a DDoS Attack? (and how to defend against one) A DDoS attack drowns your service in traffic from thousands of sources until it buckles. Here's how these attacks work, the main types, and the practical layers of defence. Your site is suddenly unreachable, your servers are pinned, and the traffic graph looks like a wall. But there's no marketing campaign, no viral moment — just a flood. You may be on the receiving end of a DDoS attack : someone deliberately overwhelming your service until it falls over. ## What a DDoS attack is A DDoS (Distributed Denial of Service) attack tries to make a service unavailable by flooding it with more traffic or requests than it can handle . The "distributed" part is key: the flood comes from many sources at once — often a botnet of thousands of compromised devices — which makes it hard to simply block one offender. DoS DDoS Source One machine Many (a botnet) Hard to block? Easier (block one IP) Hard (thousands of IPs) Scale Limited Can be enormous ## The main types DDoS attacks hit at different layers: Type What it floods Example Volumetric Your bandwidth A massive flood of junk packets Protocol Connection state SYN floods exhausting connection tables Application Your app's resources Hammering an expensive endpoint (Layer 7) The trickiest is application-layer (Layer 7) : instead of brute volume, it sends seemingly-legitimate requests to expensive endpoints (a search, a login), exhausting your app while looking almost like real users. ## How to defend No single thing stops a DDoS — defence is layered : - Use a [CDN](/blog/what-is-a-cdn) / edge network. This is the big one. A large edge network (built on [anycast](/blog/anycast-explained)) absorbs and spreads attack traffic across many locations, so it never concentrates on your origin. - Dedicated DDoS protection. Providers detect attack patterns and scrub malicious traffic before it reaches you. - [Rate limiting](/blog/rate-limiting-explained). Cap how many requests any client can make, blunting application-layer floods. - A [WAF](/blog/waf-explained). Filters malicious request patterns at the HTTP layer. - Overprovision and autoscale. Headroom buys time; autoscaling absorbs some surges. - Hide your origin. If attackers can't find your real server IP (only the CDN), they can't bypass your protection. The core strategy: don't try to out-muscle a DDoS at your origin — you'll lose. Put a large, distributed network (CDN/anycast) in front, so the flood is absorbed across the whole internet's worth of capacity rather than landing on your one server. ## Telling a DDoS from a real spike Sometimes "the site is overwhelmed" is just success (a launch, going viral) — not an attack. The response differs (scale up vs. mitigate), so it helps to look at the shape : a sudden flood from many unusual sources/regions hitting odd endpoints smells like DDoS; organic growth from normal referrers looks like a real spike. Either way, you first need to know it's happening — which is where monitoring comes in. ## A monitoring angle DDoS shows up as a sudden spike in errors, [503s](/blog/503-service-unavailable), and latency. The faster you detect it, the faster you mitigate. [Uptime and response-time monitoring](/blog/uptime-monitoring-101) from [multiple locations](/blog/global-monitoring-locations) tells you the instant your service starts buckling — and whether it's global (likely an attack/origin issue) or regional. ## The bottom line In one line What Flooding a service from many sources until it fails. Types Volumetric, protocol, and application-layer (Layer 7). Defence Layered — CDN/anycast first, then rate limits, WAF, scaling. Don't Try to absorb it at your single origin. A DDoS is a brute-force availability attack, and the winning move is to put a vast distributed network between it and your origin. Layer your defences, hide your origin, and monitor closely so you catch the flood the moment it starts. Related: [What is a CDN?](/blog/what-is-a-cdn), [anycast explained](/blog/anycast-explained), [rate limiting](/blog/rate-limiting-explained). [#security](/blog/tag/security)[#reliability](/blog/tag/reliability)[#networking](/blog/tag/networking) ## Start monitoring your services today WatchFor checks HTTP, DNS, SSL, ping, email and 20+ more — from around the world, with alerts to Slack, Discord, email and beyond. [Learn more](/docs/monitors)[Start free](/auth/sign-up) Share this article --- Canonical page: https://watchfor.io/blog/what-is-a-ddos-attack · Site guide: https://watchfor.io/llms.txt