What is a distributed denial-of-service attack?¶
The practical answer¶
A distributed denial-of-service attack, or DDoS attack, uses many sources or intermediaries to overwhelm a service or resource.
The key evidential caution¶
The dangerous assumption is that many source addresses mean many offenders.
They may represent compromised devices, spoofed traffic, reflectors, proxies or cloud systems controlled through one campaign.
A DDoS attack may involve:
Key points¶
- large traffic volume
- many connection attempts
- repeated application requests
- reflection and amplification
- botnet activity
- rapid source rotation
- traffic from several regions or providers
What investigators should establish¶
Investigators should identify:
Key points¶
- the target service
- attack start and end
- traffic type
- protocol
- source pattern
- volume
- resource affected
- mitigation applied
- provider observations
- whether traffic reached the target directly or through intermediaries
Evidential limits¶
Do not treat every large multi-source event as malicious.
Popular services, failed software updates or legitimate campaigns can create sudden distributed demand.
The strongest evidence combines traffic pattern, resource impact, request characteristics and provider assessment.
Source IP addresses may belong to innocent compromised systems and should not be treated as direct offender identities.
Where a provider or mitigation service filtered the traffic, preserve their native records promptly.
Distributed traffic may also be produced by legitimate global users or content-delivery systems. Compare request content, timing, source reputation and normal geographical patterns before classifying the event. Where attack traffic is spoofed or reflected, the apparent source count may not represent the number of participating devices.
Preserve mitigation-provider summaries, raw flow data and packet characteristics before retention expires. If the attack changes method during the incident, record each phase separately rather than reducing the event to one average volume or one protocol.
Operational takeaway¶
Treat DDoS as coordinated or automated disruption from distributed sources, and separate the attacking infrastructure from the person directing it.