What is carpet bombing?
Carpet bombing spreads a DDoS attack across hundreds of addresses in a prefix, so per-IP detection thresholds stay silent while the uplink still fails.
Last updated:
Carpet bombing, also called a prefix-wide attack, inverts the usual DDoS pattern. Instead of concentrating the whole volume on one address, the attacker spreads it thinly across hundreds or thousands of addresses inside your /24 or /22. The total comfortably saturates the uplink, yet no single address looks like it is under attack, because each one receives a few percent of what would trigger an alarm.
Why classic detection misses it
Most DDoS detection works on thresholds counted per destination address: so many megabits or packets per second to one /32 triggers a response. That model assumes the attack has a point target. Carpet bombing breaks the assumption at its root. You can have a congested link and silent alarms at the same time, and the operator hears about the problem from subscribers rather than from monitoring.
Why the usual responses fail
- RTBH would mean blackholing hundreds of addresses or the whole prefix, cutting off exactly the customers it was meant to protect.
- FlowSpec rules written for specific addresses cannot keep up with a target that moves across the prefix during the attack.
- Diverting the entire prefix to an external scrubbing centre pulls every customer off their normal path, including those nobody is attacking.
- Protection bought per IP address, common in hosting, is useless here because the target is not a single address.
What actually helps
Effective defence has to look at the prefix as a whole and cannot rely on per-address thresholds. Aggregating telemetry at prefix level restores visibility: the total climbs even when each address looks calm on its own. Mitigation itself is best based on the properties of the packet and the session rather than on where the packet is headed. A stateful filter drops traffic that belongs to no established connection, and it does not care whether the attack targets one address or a thousand, because spreading it across more addresses does not make those packets any more genuine.
Who gets hit most
The most exposed are ISPs, hosting providers and data centres, that is networks holding large, densely populated prefixes. With CGNAT the effect is especially harsh, since hundreds of subscribers sit behind a single attacked address. The attack is also used as cover: the distributed noise draws attention and occupies the team while the real target takes a separate, precise hit.
Frequently asked questions
How do I spot carpet bombing in monitoring?
The signal is a gap between the uplink utilisation graph and silence in per-address alerts. It is worth adding a view that aggregates traffic at prefix level and comparing it against the sum of point thresholds. The distribution across destination addresses helps too: normal traffic is very uneven, because some addresses work hard, while under this attack it looks suspiciously flat.
Is carpet bombing the same as a distributed attack?
Not quite. Every DDoS attack is distributed on the source side, since it comes from many machines. Carpet bombing is also distributed on the target side, across destination addresses within one prefix, and it is that second property that breaks classic detection.