DDoS gets talked about vaguely, "someone flooded our servers," without much precision about what's actually happening or why the obvious fix, more capacity, doesn't solve it the way people assume. Let me break down the mechanics, because understanding what's actually happening changes what defenses actually make sense.
The basic idea, stripped down. A denial-of-service attack tries to make a system unavailable to legitimate users, and the distributed version does it using many sources at once, often thousands or millions of compromised devices, a botnet, sending traffic simultaneously, so it's not one attacker you can just block, it's an overwhelming number of sources acting together. The "distributed" part is what makes it hard, because there's no single IP to ban your way out of.
Volumetric attacks: the brute-force version. The simplest kind just tries to saturate your bandwidth or infrastructure with sheer traffic volume, more requests than your systems or your network connection can physically handle, so legitimate traffic gets crowded out or your infrastructure simply falls over under the load. This is the "why doesn't more capacity fix it" case worth understanding directly: attackers can often generate more traffic than you can reasonably provision for, because they're not constrained by a single connection or a single machine, they're coordinating a huge number of sources. You can't out-provision an attacker who can always add more sources faster than you can add more servers, that's an arms race you lose on cost alone.
Protocol attacks: exploiting how the handshake works, not how much traffic there is. Rather than pure volume, these exploit specific weaknesses in how network protocols establish and maintain connections. A classic pattern is starting connection handshakes and never completing them, deliberately, at scale, exhausting the resources your server allocates for pending connections until it can't accept new legitimate ones, without needing enormous overall traffic volume to do it. This is why "we have plenty of bandwidth" doesn't mean you're safe, a protocol attack can take you down using a resource other than raw bandwidth entirely, one you might not have been watching.
Application-layer attacks: the sneaky, low-volume, hardest-to-spot kind. These specifically target application-level functionality, requests that look like completely normal traffic on the surface, but concentrated on the operations that are expensive for your application to actually process, database queries, search, anything computationally heavy, so a comparatively modest volume of requests can still overwhelm your systems because each request costs you disproportionately more to handle than a normal one. This is the hardest category to detect precisely because the traffic often looks legitimate, it's not an obvious flood, it's a moderate stream of requests that happen to all hit your most expensive endpoints at once. Traffic-volume-based detection alone misses this category entirely.
Why "just scale up" fails as a general defense, and it's worth being precise about why. For volumetric attacks specifically, more capacity helps up to a point, but attackers frequently have access to more aggregate capacity than you can cost-effectively provision for, especially against a large or rented botnet, so pure scaling is often a losing cost equation, not a real solution. And for protocol and application-layer attacks, more raw capacity often doesn't help at all, because the bottleneck isn't your bandwidth or your server count, it's a specific resource being exhausted, connection slots, expensive query processing, that scaling generic infrastructure doesn't directly address. "Just add more servers" is a reasonable instinct for exactly one of the three categories, and even there it's an expensive arms race, not a real win.
What actual defenses look like, matched to the attack type. Traffic filtering and rate limiting help absorb volumetric attacks, dropping or throttling excessive traffic before it reaches your core infrastructure. Specialized DDoS mitigation services, which have far larger absorption capacity than most individual companies could ever provision for themselves, are specifically built to handle massive-scale attacks by sitting in front of your infrastructure and absorbing the flood before it gets anywhere near you. And detecting application-layer attacks specifically requires looking at behavior and patterns, not just raw volume, because the traffic looks legitimate on the surface and only stands out once you're watching what it's actually doing, not just how much of it there is.
**Have an actual response plan, because the moment of attack is the worst time to
Top comments (0)