What is a DDoS attack?

A DDoS attack (Distributed Denial of Service) is an attempt to make a service unavailable by simultaneously exhausting its resources with traffic from many distributed sources. Unlike a single-host DoS, a DDoS spreads its origin across thousands or millions of IP addresses. This makes the traffic hard to filter by address alone and lets the attacker amass a volume that exceeds the victim's link capacity. The goal is not a break-in but a denial of service: exhausting bandwidth, the state tables of network devices, or the capacity of the application itself.

Anatomy: botnets and amplification

Most large attacks rely on a botnet, a network of compromised devices (PCs, servers, IP cameras, IoT routers) controlled by the attacker. The second pillar is amplification. The attacker sends small queries with the victim's address spoofed as the source to open servers (DNS, NTP, memcached), which reply with far larger packets aimed at the victim. Amplification factors can be very high: memcached reached on the order of 50,000x. Amplification depends on source-address spoofing, which is prevented by egress filtering per BCP 38 (RFC 2827).

• Attacker (C2): a command-and-control server steering the botnet over a hidden control channel.
• Bots and reflectors: compromised devices or misconfigured open servers that generate traffic.
• Source spoofing: forging the sender address to the victim's, a precondition for reflection and amplification attacks.
• Victim: a single /32 address, a prefix, an uplink, or a specific application.

Volumetric and protocol attacks

Volumetric attacks aim to saturate the link with sheer volume and are measured in bits per second (Gb/s, Tb/s); typical vectors are UDP amplification via DNS, NTP, SSDP or memcached. Protocol attacks target the state of Layer 3 and 4 devices: they exhaust the connection tables of firewalls, load balancers and TCP stacks and are measured in packets per second (pps). The classic example is a SYN flood, which leaves half-open connections in the state table, along with ACK floods and IP fragmentation attacks. Both classes can largely be filtered without inspecting application content.

Application-layer attacks (L7)

Layer 7 attacks mimic legitimate traffic: a flood of seemingly valid HTTP GET/POST requests, DNS queries or login attempts that overwhelm the application, database or backend at relatively low bit volume. Because each request looks valid, it cannot be filtered by volume or protocol alone. These attacks require behavioral analysis, rate limiting and often application-level response. That makes them the hardest class to mitigate, even though by pps or bps they look modest.

How AS202520 SkyPass sees it

As the operator of AS202520 we observe attacks through telemetry on edge routers in our Warsaw and Wrocław PoPs and on BGP sessions at the THINX, TPIX, WRIX, POZIX and 1-IX exchanges. Knowing the attack class drives the response. A volumetric attack is suppressed closer to the source and through RTBH announcements at upstream providers, a protocol attack is constrained with BGP FlowSpec rules, and an application attack needs selective filtering. That response layer is covered in our anti-DDoS protection guide. This article focuses on the anatomy and classification of the attacks themselves.