DDoS activity is still a major concern in 2026. Cloudflare reported mitigating 23.2 million network-layer DDoS attacks during the first half of 2026. These figures reflect Cloudflare’s own network observations, not the entire internet. To stay secure, we will differentiate between DoS and DDoS attacks in this blog.
What is a denial of service DoS attack?
A DoS (Denial of Service) attack is designed to reduce or stop access to an online service by exhausting resources or exploiting a condition that affects availability. It can target network bandwidth, server resources, application capacity, or a vulnerable service.
For example, a system might receive far more requests than it can process. Resources such as CPU time, memory, connection capacity, or bandwidth may become unavailable to legitimate users.
DoS does not always require massive traffic. Some denial-of-service conditions can result from specially crafted requests that trigger excessive resource use or exploit a software weakness.
Purpose: The goal is disruption, not stealing information directly.
What is a DDoS attack?
A useful DDoS attack definition is a denial-of-service attack that comes from multiple distributed sources. Those sources may include compromised computers, servers, routers, Internet of Things devices, or third-party systems that are abused as part of the traffic flow.
Because traffic arrives from many places, simply blocking one source may not solve the problem.
A DDoS incident can target bandwidth, networking infrastructure, DNS services, web applications, APIs, or other internet-facing services.
CISA notes that DDoS attacks can slow or make internet-accessible servers unavailable and prevent legitimate users from reaching online resources.
DoS vs DDoS: What is the difference?
The basic difference between DDoS and DoS attack activity comes down to distribution and scale.
| Factor | DoS | DDoS |
| Traffic source | Usually one main source | Multiple distributed sources |
| Scale | Often smaller | Can become very large |
| Blocking sources | May be more straightforward | More difficult when sources are widely distributed |
| Main goal | Disrupt availability | Disrupt availability |
| Potential targets | Servers, networks, apps | Servers, networks, DNS, apps, APIs |
| Defense | Filtering and system protections | Usually requires layered and upstream mitigation |
A DDoS attack is essentially a distributed denial-of-service attack. The distributed nature can increase traffic volume and make malicious requests harder to separate from legitimate ones.
Common types of DoS and DDoS attacks
Current defensive guidance commonly organizes DDoS activity into three broad areas: volumetric, protocol or infrastructure, and application-layer attacks.
1. Volumetric attacks
Volumetric attacks attempt to consume available bandwidth with unusually large amounts of traffic. Reflection and amplification attacks can fall into this category. They abuse exposed internet services to increase the amount of traffic reaching a target.
- DNS-related activity remains particularly relevant.
- Cloudflare reported that DNS-based attacks represented 34.3% of network-layer DDoS activity it observed in the first half of 2026.
2. Protocol attacks
Protocol attacks target network resources or how systems maintain connections.
A SYN flood is one example. It can consume connection-handling resources by generating many incomplete connection attempts.
Organizations can reduce exposure through network-level filtering, managed protection systems, capacity planning, and properly configured infrastructure.
3. Application-layer attacks
Application-layer, or Layer 7, attacks target websites, APIs, and other applications.
An HTTP flood is a common example. Large numbers of web requests can consume application or backend resources until legitimate requests slow down or fail.
These attacks can be challenging because malicious requests may resemble normal user activity.
Web application firewalls, behavioral detection, request controls, rate limiting, caching, and managed DDoS services can form part of a defensive strategy.
What about Ping of Death and zero-day attacks?
Older discussions of DoS attacks often include the Ping of Death. It relied on weaknesses in how older systems handled malformed or oversized packets.
Modern systems have addressed many historic versions of this problem, though keeping operating systems, network equipment, and firmware updated remains important.
A zero-day vulnerability is different. “Zero-day” describes a newly discovered or previously unknown vulnerability for which effective fixes may not yet be widely available. It is not a specific category of DDoS attack.
A vulnerability can potentially be exploited to cause denial of service, but zero-day attacks should not be listed as a standalone DDoS technique.
Signs of a possible DoS or DDoS attack
A slow website does not automatically mean you are experiencing an attack. Hosting failures, traffic spikes, configuration errors, application bugs, hardware problems, and upstream network outages can create similar symptoms.
Possible warning signs include:
- Sudden and unexplained traffic increases
- Unusual request patterns
- Very high bandwidth consumption
- Sharp increases in server resource use
- Large numbers of failed or incomplete connections
- Websites or APIs becoming unavailable
- Traffic coming from unusual patterns or many sources
Monitoring matters because organizations must first separate malicious activity from normal traffic or technical failures.
According to the GovDelivery report, CISA recommends contacting network administrators and upstream providers when a DoS or DDoS incident is suspected. Providers may help determine the cause and support traffic mitigation or rerouting.
DoS attack prevention and DDoS mitigation
Complete DoS attack prevention cannot always be guaranteed. A stronger strategy focuses on reducing exposure, detecting unusual activity early, and limiting attack impact.
1. Use managed DDoS protection
Dedicated DDoS attack mitigation services can detect abnormal traffic and filter malicious requests before they reach critical infrastructure.
For public-facing websites, protection at the network edge is especially useful because very large attacks may exceed the origin server’s available bandwidth.
2. Use CDNs and distributed infrastructure
Content delivery networks can distribute traffic across multiple locations. This reduces dependence on a single server and can help absorb traffic spikes. Cloud architectures can also use load balancing and automatic scaling.
AWS recommends edge services, load balancing, WAF controls, and scalable infrastructure as parts of a layered DDoS-resilience strategy.
3. Protect the application layer
- A web application firewall can analyze HTTP traffic before requests reach an application.
- Rate controls and behavioral detection can help manage unusual request volumes.
- Rules need careful tuning. Overly aggressive filtering can accidentally block legitimate visitors.
4. Reduce unnecessary internet exposure
Services that do not need public internet access should not be exposed.
5. Monitor normal traffic patterns
Businesses should understand what normal traffic looks like before an incident happens.
Monitor bandwidth, request rates, error rates, latency, application health, and infrastructure capacity.
Traffic baselines make unusual activity easier to identify.
6. Create a DDoS response plan
A response plan should define who contacts the hosting provider, ISP, DDoS protection service, security team, and business leadership during an incident.
Can a VPN prevent DoS or DDoS attacks?
A VPN should not be presented as a complete DDoS attack mitigation solution.
For an individual user:
- A VPN generally replaces the public IP visible to internet services with the VPN server’s public IP for routed traffic.
- This may reduce exposure of the user’s regular public IP in some situations. That does not mean a VPN prevents DDoS attacks.
Therefore, attackers may target VPN infrastructure, exposed services, business servers, or an already known IP address.
For businesses running public websites or applications, proper DDoS protection usually requires upstream filtering, scalable infrastructure, CDN or edge protection, network controls, application-layer defenses, and incident response planning.
A VPN can still be useful for secure remote connectivity and adding an encrypted layer between a user’s device and a VPN server. Treat it as a separate security function.
Final thoughts
A DoS attack generally disrupts availability from a more limited source, while DDoS attacks distribute disruptive traffic across many sources. Effective DDoS attack mitigation depends on layered defenses, not a single tool. Managed mitigation, edge protection, monitoring, scalable architecture, secure configurations, and a tested response plan can all help reduce disruption and keep legitimate services available.
FAQs
DDoS attacks can involve more sources and much larger traffic volumes, which may make mitigation more challenging. Actual impact depends on the attack type, target, infrastructure, and available defenses.
A firewall can help protect, but it may not be enough for large attacks. If attack traffic exceeds network capacity before reaching the firewall, you may need upstream or cloud-based mitigation.
There is no fixed duration. Some attacks are brief, while others continue or return in repeated waves. Cloudflare reported that many recent attacks on its network lasted only minutes, reinforcing the value of automated defenses.
Use a layered approach that combines managed DDoS protection, CDN or edge services, traffic monitoring, application controls, scalable infrastructure, secure configuration, and an incident response plan.