# What is a Distributed Denial-of-Service (DDoS) Attack?

> A distributed denial-of-service (DDoS) attack uses many systems or traffic sources to make a service unavailable or severely degraded.

- Canonical URL: https://yellowcube.eu/glossary/distributed-denial-of-service-attack/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The attack may consume internet capacity, exhaust network or protocol state, overwhelm application resources, or trigger expensive downstream processing.

Traffic can come from compromised devices, rented infrastructure, or reflected and amplified services that send large responses toward a spoofed victim address. Not every availability incident is DDoS: configuration errors, failed dependencies, flash crowds, and capacity faults can produce similar symptoms and require different action.

Amplification is what makes modest attacker resources dangerous: small spoofed queries to open DNS, NTP, or other responders return much larger answers to the victim, multiplying the attacker’s bandwidth manifold. Mitigation therefore happens in layers — upstream or cloud scrubbing for volumetric floods, rate limits and state management for protocol exhaustion, and application-level filtering for expensive requests — since no single control handles all three vectors.

### Key points

- **Volumetric attacks:** Saturate available bandwidth with very large traffic volumes.
- **Protocol attacks:** Exhaust connection tables, network appliances, or protocol handling capacity.
- **Application attacks:** Send requests designed to consume costly application or backend resources.
- **Risk reduction:** Use upstream coordination, distributed delivery, anycast, rate controls, resilient architecture, monitoring, and practiced response procedures.
- **Important limitation:** On-premises filtering cannot recover an internet link that has already been saturated; mitigation often must occur upstream.

### Related terms

[Botnet](<https://yellowcube.eu/glossary/botnet/>) · [Domain Name System (DNS) security](<https://yellowcube.eu/glossary/domain-name-system-security/>) · [Cyber resilience](<https://yellowcube.eu/glossary/cyber-resilience/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>)

### Sources

[CISA: Understanding and Responding to DDoS Attacks](https://www.cisa.gov/sites/default/files/2024-03/understanding-and-responding-to-distributed-denial-of-service-attacks_508c.pdf) · [NIST glossary: Distributed Denial of Service](https://csrc.nist.gov/glossary/term/distributed_denial_of_service)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.