What Is a DDoS Attack? How Floods Take Connections Down

A DDoS attack — distributed denial of service — doesn't hack anything. It simply drowns a target in more traffic than its connection can carry, the digital equivalent of jamming a shop's doorway with a crowd so customers can't get in. No data is stolen; the harm is unavailability.

How it works

The "distributed" part is what makes modern attacks potent: traffic comes from thousands of sources at once — typically a botnet of malware-infected computers, routers and cameras whose owners have no idea they're participating. Attackers amplify further with spoofed-source reflection: small forged queries to public servers produce large replies aimed at the victim, multiplying bandwidth 10–100×.

Attacks target different layers: raw volumetric floods (saturate the pipe), protocol attacks like SYN floods (exhaust connection tables), and application-layer floods (overwhelm the website's logic with plausible-looking requests, hardest to filter).

DDoS against home users

Ordinary people get hit too — most often gamers, streamers and anyone who angered someone in a lobby. The attacker needs your public IP, obtained through peer-to-peer game connections, IP-grabber links, or old Skype-era leaks. The result: your internet dies for minutes to hours, then usually stops when the attacker gets bored. Cheap "booter" services sell these attacks — using them is criminal in most countries, and buyers get prosecuted.

If your connection is under attack

1. Restart your router. Most home IPs are dynamic — a new address makes the flood pointless. Leave it off several minutes.
2. If the IP didn't change, ask your ISP to rotate it; support can force a new lease.
3. Prevent the next one — use a VPN in game lobbies and calls so strangers only ever see the VPN's address (see what someone can do with your IP), and don't click unknown links.
4. Persistent harassment? Document it and report to your ISP and, where serious, law enforcement.

How websites survive attacks

Services absorb DDoS with massive distributed capacity: CDN and mitigation networks (Cloudflare, Akamai and peers) spread traffic across global points of presence, filter attack patterns, and pass only clean requests to the origin. It's an arms race measured in terabits per second — and the reason major sites shrug off attacks that would flatten any single server.

Frequently asked questions