# DDoS

> Knocking a site offline by flooding it with more traffic than it can handle.

- Level: Intermediate
- Topics: Security, Networks
- URL: https://tidbit.legios.com.ar/ddos/
- In Spanish: [DDoS](https://tidbit.legios.com.ar/es/ddos/)

A **DDoS attack** (distributed denial of service) does not break into anything: it buries a website or service under so many requests that real users cannot get through. Every server, link and router has a limit; push enough traffic at it and it slows to a crawl or falls over. 'Distributed' means the flood comes from thousands or millions of machines at once, so blocking a single IP address does nothing.

Those machines are usually a **botnet**: computers, routers, security cameras and other devices infected with malware and controlled remotely, mostly without their owners noticing. The attacker, or someone who rents the botnet to them by the hour, tells them all to send traffic at the same target. Some attacks fill the network pipe with raw volume; others are subtler and send requests that look normal but are expensive for the server to answer, like repeated searches or logins.

The defense is mostly size and filtering. Services like AWS Shield or Cloudflare sit in front of the site, spread across data centers all over the world, so the flood is absorbed by a network far bigger than any attack, and **scrubbing** systems separate the bot traffic from the people. A CDN helps on its own, because cached pages are served from the edge without touching the origin. Attacks are often used for extortion, protest or as a distraction while something else happens.

## An analogy

A shop where a crowd of hired people walks in all at once and stands in line asking for nothing. The shop is not robbed, but no real customer can get to the counter until a doorman starts telling them apart.

## Keep in mind

- A DDoS overwhelms a service with traffic; it steals nothing, it makes the service unusable.
- The traffic comes from a botnet of infected devices, so blocking one address is useless.
- Protection comes from huge networks that absorb and filter the flood before it reaches you.
- Some attacks use raw volume, others cheap-to-send, expensive-to-answer requests.

## Go deeper

- [What is a DDoS attack? (AWS Shield)](https://aws.amazon.com/shield/ddos-attack-protection/)
- [Denial-of-service attack on Wikipedia](https://en.wikipedia.org/wiki/Denial-of-service_attack)

## Related terms

- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Router](https://tidbit.legios.com.ar/router/): The box that connects your devices to each other and to the internet.
- [IP address](https://tidbit.legios.com.ar/ip-address/): The number that identifies a device on a network, like a postal address.
- [Malware and ransomware](https://tidbit.legios.com.ar/malware-and-ransomware/): Software built to harm you; ransomware locks your files and charges to unlock them.
- [AWS Shield](https://tidbit.legios.com.ar/aws-shield/): AWS's protection against DDoS attacks, on by default for everyone.
- [Cloudflare](https://tidbit.legios.com.ar/cloudflare/): A global network that sits in front of websites to make them faster and safer.
- [Data center](https://tidbit.legios.com.ar/data-center/): A building full of servers where the internet, the cloud and AI actually run.
- [CDN](https://tidbit.legios.com.ar/cdn/): Copies of a website kept on servers around the world, close to whoever asks.