What it is
How it works
-
Network floods: overwhelm bandwidth (UDP/TCP floods).
-
Protocol tricks: exhaust servers/load balancers (SYN, ACK, ICMP).
-
Application hits: target URLs/APIs that are expensive to serve (HTTP GET/POST).
-
Amplification: abuse open services (DNS/NTP/memcached) to multiply traffic.
Signs you’ll see
-
Site/API is slow or unreachable; timeouts climb
-
Spikes from a few regions or thousands of odd IPs
-
Infrastructure OK, but one URL or endpoint pegged at 100%
Defend smart (before it happens)
-
Use a DDoS-capable CDN/WAF in front of everything public.
-
Turn on rate limiting, challenge pages, and bot filtering.
-
Lock down amplifiers you control (no open resolvers); prefer anycast edge protection.
-
Create an emergency profile: cached pages, maintenance mode, and API allowlists.
If you’re under attack
-
Activate DDoS mode on CDN/WAF; raise challenges/rate limits for hot paths.
-
Block/shape by ASN/geo/signature; throttle or drop obviously bad traffic.
-
Protect the origin: only allow CDN IPs; increase autoscale limits temporarily.
-
Communicate: status page and brief updates reduce support load.
-
Capture evidence: traffic samples and logs help tune long-term rules.
DDoS attack or legitimate traffic spike?
A product launch, news event, broken client, or crawler can resemble an attack. Compare request types, source networks, geographic mix, protocol errors, cache-hit ratio, origin load, and conversion behavior. A large number of addresses may come from a botnet, while amplification attacks can make the apparent source misleading.
Mitigate upstream
Volumetric traffic must be absorbed or filtered before it saturates the connection. Use an appropriate CDN or DDoS provider, anycast capacity, origin shielding, rate limits, WAF rules, and provider escalation procedures. Do not block entire countries without evidence; it can remove legitimate users without stopping a distributed attack. Preserve logs and timing, keep status communication separate from the affected service, and review whether emergency rules caused collateral damage. Endpoint antivirus cannot stop a network link from being overwhelmed.