The attack may consume internet capacity, exhaust network or protocol state, overwhelm application resources, or trigger expensive downstream processing.
Traffic can come from compromised devices, rented infrastructure, or reflected and amplified services that send large responses toward a spoofed victim address. Not every availability incident is DDoS: configuration errors, failed dependencies, flash crowds, and capacity faults can produce similar symptoms and require different action.
Amplification is what makes modest attacker resources dangerous: small spoofed queries to open DNS, NTP, or other responders return much larger answers to the victim, multiplying the attacker’s bandwidth manifold. Mitigation therefore happens in layers — upstream or cloud scrubbing for volumetric floods, rate limits and state management for protocol exhaustion, and application-level filtering for expensive requests — since no single control handles all three vectors.
Key points
Volumetric attacksSaturate available bandwidth with very large traffic volumes.
Protocol attacksExhaust connection tables, network appliances, or protocol handling capacity.
Application attacksSend requests designed to consume costly application or backend resources.
Risk reductionUse upstream coordination, distributed delivery, anycast, rate controls, resilient architecture, monitoring, and practiced response procedures.
Important limitationOn-premises filtering cannot recover an internet link that has already been saturated; mitigation often must occur upstream.