Skip to content
Know.itKnow.it
Create an animated lesson
On request

This article is free to read. Creating a lesson uses your daily or stored credits; review the language and settings before starting.

How does a DDoS attack work?

TechnologyLesson on requestFree to read

Quick answer

A DDoS attack floods a target server with internet traffic from many compromised devices, called a botnet. The sheer volume exhausts the server's bandwidth or processing capacity, so real users cannot connect. The attacker often uses malware to control the devices remotely, coordinating the assault without the owners' knowledge.

A DDoS attack overwhelms a server or network with traffic from many compromised devices, making it unavailable to real users. The attacker uses a botnet to send a flood of requests, exhausting the target's resources.

Step by step

  1. The attacker infects many computers with malware, turning them into bots.
  2. These bots form a botnet, which the attacker controls remotely.
  3. The attacker sends a command to all bots to target a specific server.
  4. Each bot sends a flood of requests to the target's IP address.
  5. The target's resources are overwhelmed, causing service to slow or crash.
  6. Legitimate users are denied access because the server cannot handle the load.

Key things to understand

  1. Attackers first build a botnet by infecting many computers with malware.
  2. Each infected device, called a bot, can be commanded remotely without the owner's knowledge.
  3. The attacker directs all bots to send requests to a single target simultaneously.
  4. The flood of traffic consumes the target's bandwidth, memory, or processing power.
  5. Legitimate users cannot access the service because the server is overwhelmed.

Labelled diagram

  1. Attacker

    Controls the botnet and issues commands to launch the attack.

  2. Botnet

    Many compromised devices receive the command to attack.

  3. Traffic Flood

    Bots send massive requests to the target's IP address.

  4. Target Server

    Resources exhausted, cannot respond to legitimate users.

  5. Legitimate Users

    Denied access because server is overwhelmed.

How a DDoS attack overwhelms a target

Real-world examples

  • In 2016, the Mirai botnet infected IoT devices like cameras and routers to take down major websites such as Twitter and Netflix.
  • A gaming server might be hit by a DDoS attack during a tournament, causing lag and disconnections for players.
  • In 2018, GitHub suffered a massive DDoS attack peaking at 1.35 terabits per second, though it was mitigated quickly.
  • A small business website could be knocked offline by a DDoS attack launched by a competitor using a rented botnet.

Common mistake

✗ Myth: A DDoS attack is the same as hacking into a server.

✓ Fact: A DDoS attack does not break into a server; it simply overwhelms it with traffic. The goal is to make the service unavailable, not to gain unauthorized access.

People also ask

What is a DDoS attack in simple terms?
A DDoS attack is like a crowd of people blocking the entrance to a store so real customers cannot get in. In computing, many infected computers flood a website with fake traffic, making it crash or slow down so that actual users cannot access it.
How long does a DDoS attack last?
DDoS attacks can last from a few minutes to several days. Most are short, lasting under an hour, but sophisticated attacks can persist for weeks. The duration depends on the attacker's resources and the target's defenses.
Can you stop a DDoS attack?
Yes, DDoS attacks can be mitigated using specialized services that filter out malicious traffic. These services distribute the load across many servers and identify attack patterns. However, stopping an attack completely while it is ongoing is challenging without such defenses.
What is a botnet?
A botnet is a network of compromised computers, servers, or smart devices controlled by an attacker. Each device runs malware that lets the attacker command it remotely. Botnets can contain thousands or millions of devices, and their combined traffic can overwhelm most targets.
How can I protect my website from a DDoS attack?
Use a content delivery network (CDN) or DDoS mitigation service that filters malicious traffic before it reaches your server. Keep software updated, configure firewalls to rate-limit requests, and monitor traffic for unusual spikes. No single measure is foolproof, but layered defenses reduce risk.
What is the difference between a DoS and a DDoS attack?
A DoS (Denial-of-Service) attack comes from a single source, while a DDoS (Distributed Denial-of-Service) attack uses many sources. DDoS is harder to block because the traffic originates from numerous IP addresses, making it difficult to distinguish from legitimate users.
Can a DDoS attack steal data?
Typically, a DDoS attack aims to disrupt service, not steal data. However, it can be used as a smokescreen to distract security teams while other attacks, such as data breaches, occur. In some cases, the flood of traffic may exploit vulnerabilities that lead to data exposure.

Part of the guide: How the Internet Works →