How it typically works?
- Recruitment: attackers compromise many devices to build a botnet or rent botnet capacity.
- Command: a controller instructs the distributed agents to generate traffic or requests toward a target.
- Traffic amplification: when used attackers may magnify traffic through intermediary services or misconfigured servers.
- Saturation: target network or application resources are consumed causing slowdown or outage.
- Persistence and adaptation: attackers change vectors to evade mitigations and sustain pressure.
Common techniques & variants
- Volumetric attack: saturates network bandwidth with high volume packets or streams. Examples include UDP floods and large scale traffic spikes.
- Network flood: targets network infrastructure by exhausting packet handling capacity. SYN floods and ICMP floods are examples.
- Application layer attack: sends valid looking requests to web or API endpoints to exhaust server resources or backend connections. HTTP floods and slow request techniques fit here.
- Amplification attack: uses third party servers to multiply traffic toward the victim, for example DNS amplification or NTP amplification.
- Multi vector attack: combines volumetric, network and application layer methods to overwhelm defenses and complicate mitigation.
Impact
DDoS attacks disrupt availability and can cause immediate business losses, reputational damage, and regulatory exposures if services affecting customers are down. Operationally SecOps and network teams must detect traffic anomalies, execute scrubbing or rate limiting, and coordinate with upstream providers. In addition to direct downtime, DDoS is used as a smokescreen while attackers perform intrusions or data theft. Recovery carries costs in mitigation services, incident response, and potential customer compensation. For defensive planning understanding attack vectors, traffic baselines and runbooks is essential to minimize time to recovery.