Learn & Understand

The Three Types of DDoS, and Why You Can't Just Buy More Bandwidth

The companion calculator models a volumetric DDoS attack, estimating the total bandwidth a botnet could throw at a target and whether it would saturate the target's capacity. That bandwidth-flooding is the most familiar kind of denial-of-service attack, but it is only one of three distinct types, and even for volumetric attacks, simply buying more bandwidth is not a real defense. Understanding the three categories of DDoS, how amplification multiplies an attacker's firepower, and why defense relies on scrubbing rather than out-provisioning turns a bandwidth estimate into a grasp of how these attacks and their defenses actually work.

Denial of Service, Distributed

A denial-of-service attack aims to make a service unavailable by overwhelming it. A distributed denial-of-service, or DDoS, does this from many sources at once, typically a botnet of compromised devices, so the flood comes from countless addresses and cannot simply be blocked by cutting off one attacker. The goal is not to break in but to exhaust some resource, bandwidth, connection capacity, or server processing, until legitimate users cannot get through. The distributed nature is what makes these attacks hard to stop: there is no single source to filter, and the traffic can look superficially like real users.

Three Types, Not One

DDoS attacks exhaust different resources, and they fall into three broad categories.

Volumetric attacks, which the calculator models, simply flood the pipe with more traffic than it can carry. Protocol attacks exhaust the finite connection-tracking capacity of servers and network gear with malformed or half-open connections, using far less bandwidth. Application-layer attacks are the sneakiest: they send seemingly legitimate but resource-intensive requests that force the server to do expensive work, exhausting it with relatively little traffic, which makes them hard to distinguish from real users. Defending against all three requires different techniques, no single measure covers them.

Amplification: Multiplying the Firepower

The calculator's botnet-bandwidth math actually understates what attackers can achieve, because of amplification. In an amplification attack, the attacker sends small requests to third-party servers while forging the source address to be the victim's, so those servers send much larger responses to the victim. A small query can trigger a response many times its size, so the attacker's own bandwidth is multiplied severalfold by abusing these intermediaries. This is why real volumetric attacks can vastly exceed what the compromised devices could generate directly, and why the largest recorded attacks reach enormous scales. Amplification means an attacker with modest resources can generate an overwhelming flood.

Why You Can't Just Out-Provision

The intuitive defense, buy enough bandwidth to absorb the attack, does not work, and understanding why is the key insight. Attackers, especially using amplification and large botnets, can generate more traffic than almost any single organization could economically provision, so trying to win a bandwidth arms race is a losing game. Instead, modern DDoS defense relies on scrubbing: routing traffic through specialized providers with enormous distributed capacity that filter out attack traffic and pass only legitimate requests to the target. Techniques like distributing the service across many locations, absorbing and dispersing floods, and filtering malicious patterns are how attacks are actually mitigated. The defense is smarter filtering at massive scale, not simply a bigger pipe.

Understanding DDoS for Defensive Planning

Use the calculator for defensive capacity planning, to reason about how much firepower a botnet represents against a given capacity, and extend that with the full picture: DDoS comes in volumetric, protocol, and application-layer forms, amplification multiplies an attacker's bandwidth far beyond their own resources, and effective defense means scrubbing and distributing traffic rather than out-provisioning. The calculation estimates the flood; understanding the types and defenses is what informs real DDoS resilience.