Denial-of-Service Defense

A denial-of-service attack makes a service unavailable to its intended users. A distributed denial-of-service attack, or DDoS attack, sends the attack from many systems. Distribution gives an attacker more traffic sources and makes simple source blocking less effective.

Use one mental model: protect the service's narrowest resource while preserving legitimate work.

users and attackers
        ↓
internet capacity → provider edge → application edge → service → dependencies
        bandwidth       filtering       admission       work       work

An attack only needs to exhaust one limiting resource. That resource might be link bandwidth, packet-processing capacity, connection state, worker time, database connections, memory, or a paid dependency. Your defense must act before traffic consumes that resource.

What denial of service means

Availability is a property observed by a user. A server can remain powered on while users receive timeouts, errors, or unusable latency. Monitor the user-visible service, not only the health of individual machines.

DoS describes the effect and attack goal. DDoS describes a distributed source pattern. Neither term identifies one protocol or one mitigation.

DoS can result from several forms of exhaustion:

• Volumetric exhaustion fills network capacity with bits or packets.
• Protocol-state exhaustion consumes state in a host, firewall, proxy, or load balancer.
• Application-resource exhaustion sends requests that consume disproportionate compute, memory, storage, database work, or downstream calls.
• Reflection and amplification cause third-party systems to send replies toward a spoofed victim address. Amplification makes the replies larger or more numerous than the triggering requests.

These categories can overlap. A campaign may change vectors as defenders apply controls.

Start with the service, not the attack name