A DDoS attack doesn't steal your data. It does something simpler and nastier: it makes your website unavailable by drowning it in fake traffic. This post explains what it is and — the interesting part — how defenders tell fake visitors from real ones.
What DDoS means
DDoS = Distributed Denial of Service.
- Denial of Service = make a system unusable for real users.
- Distributed = the attack comes from thousands of hijacked machines at once (a botnet), not one source.
| Term | Meaning |
|---|---|
| DoS | One attacker flooding you |
| DDoS | An army of hijacked machines flooding you together |
| Botnet | The network of hijacked machines doing the flooding |
The real-life picture
Imagine 10,000 fake customers mob a restaurant's front door.
Nobody gets robbed. No food is stolen. But no real diner can get in. That's DDoS — you're not breached, you're blocked.
10,000 fake requests/sec ──▶ 🚪 your server ──▶ 💥 overwhelmed ──▶ real users locked out
Why it's hard to stop
Here's the tricky part: each fake request looks individually legit. There's no "I am evil" label on any single one. The attack lives in the pattern and the volume, not in any one request.
So defenders can't just check one request and decide. They need to look at behavior across many.
How defenders tell fake from real
There's no single test. It's a scorecard of clues:
| Clue | Real user | Attack traffic |
|---|---|---|
| Rate | A few requests a minute | Thousands per second from one source |
| Behavior | Browse → click → order | Hammers one URL, no real journey |
| Fingerprint | Normal browser headers | Missing, fake, or identical headers |
| Location | Spread out naturally | Sudden flood from odd regions |
| Reputation | Clean IP address | IP on known-botnet lists |
| Challenge | Solves a CAPTCHA / runs JavaScript | Bot can't complete it |
| Timing | Human-like, irregular | Machine-perfect, robotic intervals |
The key idea: no single clue decides. The system scores each request across all of them. High suspicion → block, challenge, or slow it down. It's probability, not certainty — which is exactly why DDoS defense is never 100% perfect.
The main types
| Type | What it attacks | Example |
|---|---|---|
| Volumetric | Your bandwidth | A sheer firehose of traffic |
| Protocol | Your connections | Opens thousands of half-finished connections |
| Application (L7) | Your expensive endpoints | Spams /search to melt the database |
How it's defended in the cloud
- Dedicated DDoS protection absorbs and filters network floods before they reach you.
- Edge/CDN networks (like a global front door) spread traffic across the world so no single point drowns.
- On Azure: Azure DDoS Protection + Front Door at the edge.
The whole thing in one line
DDoS = drown the system in fake traffic so real users can't get in. You can't spot it from one request — you catch it by scoring the pattern across thousands.
Top comments (0)