What is DDoS?

A DDoS (Distributed Denial of Service) attack is an attempt to knock a service offline by flooding it with traffic or requests from many sources at the same time.

"Distributed" is what separates it from a plain denial-of-service attack: the traffic comes from thousands of machines, usually compromised devices in a botnet, so blocking one source address achieves nothing. Attacks fall into a few broad groups. Volumetric attacks simply send more traffic than the target's links can carry. Many use reflection and amplification: the attacker sends small requests with a forged source address to open DNS resolvers, NTP servers or similar services, and their much larger replies all land on the victim. Protocol attacks, such as a TCP SYN flood, exhaust connection tables in servers, firewalls and load balancers. Application-layer attacks send expensive but legitimate-looking requests, such as web searches, that wear down the server rather than the network.

For a network engineer, the uncomfortable fact about a volumetric attack is that nothing you configure on your own router helps once your upstream links are full: the damage is done before the packets arrive. Defences therefore move upstream. RTBH asks your transit providers, via a BGP community, to drop all traffic to the attacked address at their edge, sacrificing that one address to save the rest. Scrubbing services take traffic for your prefixes, filter out the attack and pass clean traffic back. Closer to home, rate limits, SYN cookies and well-sized state tables deal with smaller protocol attacks. Preventing your own network from being used is part of the picture too: source address filtering stops forged packets leaving, and closing open resolvers removes amplifiers. The BGP communities, prepending and RTBH lesson triggers a real blackhole for an attacked address.