DDoS
acronymsecuritynetworking
Stands for: Distributed Denial of Service
An attack that overwhelms a service with traffic from many sources at once.
A Distributed Denial of Service floods a target from a botnet of many machines, making it hard to block by simply filtering one address. It aims at availability, taking you offline, rather than stealing data, and mitigation relies on absorbing or scrubbing the flood.
A distributed denial of service floods a target from many sources at once, which defeats the obvious defence of blocking the origin because there are too many origins and they are usually innocent machines. Volumetric attacks saturate the link, protocol attacks exhaust state tables, and application-layer attacks issue requests that are individually legitimate and collectively ruinous.
The defence has to be upstream of the bottleneck, which is why mitigation is generally a service rather than a device: a firewall on a saturated link is behind the problem it is meant to solve. Amplification is the multiplier that makes the largest attacks possible, and the reason source address validation at network edges matters even to operators who will never be a target.
Also known as: ddos, dos, denial of service, volumetric attack