Modern applications are expected to be available 24/7. Whether you’re running a personal portfolio, an e-commerce store, or a large SaaS platform, downtime can result in lost users, damaged reputation, and financial losses.

One of the biggest threats to service availability is a Denial of Service (DoS) attack. When attackers use thousands of compromised devices instead of a single machine, it becomes a Distributed Denial of Service (DDoS) attack.

This article explains how these attacks work, how they differ, and the techniques used to defend against them.

Understanding Denial of Service (DoS)

A Denial of Service (DoS) attack attempts to make an application, server, or network unavailable by overwhelming it with more traffic or requests than it can handle.

Every server has limits:

• CPU capacity
• Memory
• Network bandwidth
• Disk I/O
• Maximum concurrent connections

When these resources become exhausted, legitimate users may experience:

• Slow response times
• Connection timeouts
• Failed requests
• Complete service outages

Unlike data theft or malware infections, the primary objective of a DoS attack is to disrupt availability.

What Makes DDoS Different?

A Distributed Denial of Service (DDoS) attack works similarly but is much larger in scale.

Instead of sending traffic from a single computer, attackers use thousands or even millions of compromised devices called a botnet.

These devices may include:

• Personal computers
• Servers
• IoT devices
• Security cameras
• Routers
• Smart home devices

Because requests originate from many different locations, blocking a single IP address becomes ineffective.

A Simple Example

Imagine a restaurant with 100 seats.

On a normal day:

• Customers arrive gradually.
• Staff can serve everyone comfortably.

During a DoS attack:

• One person repeatedly enters the restaurant, occupies tables, and prevents real customers from being served.

During a DDoS attack:

• Thousands of fake customers arrive simultaneously from every entrance.
• The restaurant becomes completely overwhelmed.

The kitchen isn’t broken.

There are simply too many fake customers consuming all available resources.

Common Types of DoS and DDoS Attacks

Different attacks target different parts of the network stack.

1. SYN Flood

A SYN Flood abuses the TCP three-way handshake.

Normally:

Client -> SYN
Server -> SYN-ACK
Client -> ACK

During a SYN Flood:

• The attacker sends thousands of SYN packets.
• The final ACK is never sent.
• The server keeps waiting for connections that never complete.

Eventually, the server’s connection queue fills up.

New legitimate users cannot connect.

2. UDP Flood

UDP is connectionless.

Attackers simply send massive amounts of UDP packets to random ports.

The server must:

• Process each packet
• Determine whether the destination port exists
• Generate responses when necessary

Large UDP floods can quickly consume bandwidth and CPU resources.

3. HTTP Flood

Instead of attacking the network, an HTTP Flood targets the application itself.

Attackers repeatedly request pages like:

GET /products
GET /search
GET /checkout

These requests often appear legitimate.

Because they resemble normal user behavior, HTTP Flood attacks are harder to detect than basic network attacks.

4. DNS Amplification

DNS amplification is a reflection attack.

The attacker:

1. Sends small DNS requests.
2. Spoofs the victim’s IP address.
3. Public DNS servers send much larger responses to the victim.

A tiny request can generate a response many times larger.

This “amplifies” the attack traffic dramatically.

5. ICMP Flood (Ping Flood)

Attackers continuously send ICMP Echo Requests (ping packets).

The server spends CPU and bandwidth replying to each request.

Large ICMP floods can significantly degrade network performance.

How DoS Protection Works

DoS protection combines multiple defense mechanisms rather than relying on a single solution.

Rate Limiting

Rate limiting restricts how many requests a client can make within a specific time window.

Example:

100 requests per minute per IP

If an IP exceeds the limit:

• Requests are delayed
• Requests are rejected
• Temporary blocks may be applied

Rate limiting is especially useful for:

• Login endpoints
• Search APIs
• Password reset endpoints
• Public APIs

Firewalls

Firewalls inspect incoming traffic and apply security rules.

They can block:

• Suspicious IP addresses
• Unexpected ports
• Malformed packets
• Unauthorized protocols

Network firewalls and Web Application Firewalls (WAFs) often work together.

Traffic Filtering

Modern protection systems continuously analyze traffic patterns.

They look for signs such as:

• Unusual request spikes
• Identical request patterns
• Geographic anomalies
• Bot-like behavior

Malicious traffic is filtered before reaching the application.

Load Balancing

Instead of relying on one server, incoming requests are distributed across multiple servers.

Benefits include:

• Better performance
• Higher availability
• Improved fault tolerance
• Reduced overload on individual servers

Even if one server becomes overloaded, others continue serving users.

Content Delivery Networks (CDNs)

CDNs cache static resources close to users around the world.

Examples include:

• Images
• CSS files
• JavaScript
• Videos

Benefits:

• Reduced latency
• Lower bandwidth usage
• Better resilience during traffic spikes

Many CDNs also include built-in DDoS mitigation.

Traffic Scrubbing

Traffic scrubbing centers act like security checkpoints.

Incoming traffic is analyzed.

Legitimate requests are forwarded.

Malicious requests are discarded.

This prevents attack traffic from ever reaching your infrastructure.

CAPTCHA Challenges

When suspicious activity is detected, users may be asked to solve a CAPTCHA.

This helps distinguish:

• Real humans
• Automated bots

CAPTCHAs are commonly used on:

• Login pages
• Registration forms
• Contact forms

Best Practices for Preventing DoS and DDoS Attacks

No single technique can stop every attack.

A layered defense provides the strongest protection.

Rate Limiting

Rate limiting restricts how many requests a client can make within a specific time window.

Example: 100 requests per minute per IP

If an IP exceeds the limit, requests can be delayed, rejected, or temporarily blocked. This is especially useful for protecting critical endpoints such as:

• Login
• Registration
• Password reset
• Search
• Public APIs

These endpoints are common attack targets because they’re computationally expensive or easy to abuse at scale.

Deploy a Web Application Firewall (WAF)

A WAF inspects incoming HTTP traffic and filters malicious requests before they reach your application. It can block suspicious IPs, malformed requests, and known attack patterns, often working alongside a network firewall that blocks unexpected ports and unauthorized protocols.

Enable CDN Protection

CDNs cache static resources (images, CSS, JavaScript, videos) close to users around the world, reducing latency and absorbing large traffic volumes before they ever hit your origin server. Many CDNs also include built-in DDoS mitigation and traffic scrubbing, where incoming traffic is analyzed and only legitimate requests are forwarded on.

Use Traffic Filtering and Monitoring

Continuously analyze traffic patterns for signs such as:

• Sudden traffic spikes
• Identical or bot-like request patterns
• Unusual geographic sources
• Increased error rates
• High CPU or bandwidth usage

Early detection often prevents major outages, and suspicious traffic can be challenged with a CAPTCHA to distinguish real humans from automated bots — commonly used on login, registration, and contact forms.

Scale Horizontally with Load Balancing

Distribute incoming requests across multiple servers instead of relying on one. Even if a single server becomes overloaded, others continue serving users, improving both performance and fault tolerance.

Protect Critical Endpoints

Apply stricter controls to endpoints such as:

• Login
• Registration
• Password reset
• Search
• Public APIs

These endpoints are common attack targets.

Real-World Example

Suppose your online store normally receives:

2,000 requests per minute

During an attack:

500,000 requests per minute

Without protection:

• CPU usage reaches 100%.
• Memory is exhausted.
• Customers cannot browse products.
• Orders fail.

With proper DoS protection:

• Rate limiting blocks abusive clients.
• A CDN absorbs much of the traffic.
• A WAF filters malicious requests.
• Load balancers distribute legitimate traffic.
• Suspicious traffic is scrubbed before reaching your servers.

As a result, real customers continue shopping with minimal disruption.

TL;DR

DoS (single source) and DDoS (distributed sources) attacks overwhelm applications with excessive requests, leading to slowdowns or outages. Common types include SYN floods, UDP floods, HTTP floods, DNS amplification, and ICMP floods. Effective protection requires a layered approach: rate limiting, Web Application Firewalls (WAFs), Content Delivery Networks (CDNs), continuous traffic monitoring, horizontal scaling with load balancing, and protection of critical endpoints like login and search. By implementing these strategies, you can significantly improve your application’s resilience and keep it available even under heavy malicious traffic.

Availability is a core pillar of application security. Building for resilience from the start is far easier than trying to recover from a successful attack.