DDoS: what it is and why it works

Your service is working fine. Then, without warning, requests start timing out. The traffic looks normal on your monitor — same request count, same sizes — but responses slow from 50 ms to 5 seconds. You check the logs and see 10 million requests per second from a hundred thousand different IPs. An adversary is attacking.

What DDoS means. Distributed Denial of Service — an attacker sends so much traffic from so many different sources that your service cannot respond to real users. The attacker does not steal data or inject commands. They just make your service unavailable. The “distributed” part is what makes it hard to stop: you cannot simply block one IP address.

Why it happens constantly. Cloudflare blocks on average ~110 million DDoS requests per day. Botnets — networks of malware-infected computers and IoT devices — are cheap to rent. Attacker cost: ~$50–500/month for a 10 Gbps-capable botnet service. For a competitor or bad actor, that is a low-cost way to take down a rival’s service.

The three types of attacks.

Volumetric attacks (L3/L4) aim to saturate the network pipe itself — gigabits of UDP, ICMP, or DNS responses flood the link before your server even sees the packets.

Protocol/state-exhaustion attacks (L3/L4) aim to fill connection-tracking tables and exhaust kernel memory — SYN floods force your server to hold thousands of half-open TCP connections until it runs out of slots and drops legitimate connections.

Application-layer attacks (L7) look like legitimate traffic but are expensive to process — HTTP floods, slow requests that hold connections open for minutes (Slowloris), or queries hitting expensive database paths. These are the hardest to stop because they pass every port and rate check.

How a CDN scrubbing center helps. When you serve traffic directly from your origin, a 100 Gbps attack saturates your upstream link and legitimate requests never reach your server. A CDN with DDoS scrubbing routes all traffic to its nearest Point of Presence (PoP) first. The PoP has provisioned bandwidth to absorb the attack across its global infrastructure, and only clean traffic is forwarded to your origin. You stay online because the attack is distributed across the CDN’s network, not concentrated on your server.

The arms race. Bea runs a web service. Sven says “I’ll flood you with so much traffic you cannot serve real users.” Bea replies “I have a rate limiter — I reject the thousandth request per second from any IP.” Sven: “I will use a thousand different IPs.” Bea: “Then I have a WAF to detect the attack pattern. Legitimate users make normal requests; your flood is suspicious.” This back-and-forth is not hypothetical — it describes real attacker adaptations measured over years.