Types of DDoS Attacks and How to Protect Against Them

A DDoS attack (Distributed Denial of Service) sends heavy traffic to a server, website or network from many devices at once in order to slow the service down or make it completely unreachable. Attacks usually rely on botnets made up of compromised computers and IoT devices.

In this article we explain the types of DDoS attacks, their warning signs and how to choose the right protection for your server or website.

The Difference Between DoS and DDoS

A DoS attack comes from a single source, and blocking that source is often enough. In a DDoS attack, traffic comes from thousands of different IP addresses; since blocking them one by one isn't possible, you need protection that can separate attack traffic from clean traffic.

Types of DDoS Attacks

DDoS attacks are grouped into three main categories according to the layer they target.

1. Volumetric attacks

The goal is to saturate the target's internet connection with traffic. They are usually measured in bits per second (Gbps).

• UDP flood: a large number of UDP packets are sent to the target.
• Reflection and amplification attacks: the attacker sends small requests with a spoofed source address to open servers such as DNS, NTP or memcached, which send much larger responses to the target.
• ICMP (ping) flood: the target is kept busy with a huge number of ping requests.

2. Protocol attacks

These aim to exhaust the connection tables of servers, firewalls or load balancers. They are measured in packets per second (pps).

• SYN flood: TCP connections are started but never completed, filling the server with half-open connections.
• ACK and fragmented packet attacks: strain the processing capacity of network devices.

3. Application layer (Layer 7) attacks

Requests that look like real visitors are sent to the web server. Even at low traffic volumes they can exhaust the server's CPU and database resources. They are measured in requests per second (rps).

• HTTP flood: thousands of requests are sent to heavy pages such as the home page, search or cart.
• Slowloris and slow attacks: connections are kept open by sending data very slowly until the server's connection limit is reached.
• Login and form attacks: login or contact forms are triggered over and over.

Signs of a DDoS Attack

• The site or server suddenly becomes very slow or doesn't open at all
• Unexplained spikes in bandwidth or CPU usage
• Thousands of requests to the same page in a short time in the access logs
• Unusual traffic from particular countries or IP blocks
• Players disconnecting en masse on game servers

Remember that slowness isn't always DDoS; a sudden rise in real traffic, a faulty plugin or insufficient resources can cause similar symptoms.

How Does DDoS Protection Work?

• Network-level filtering: volumetric and protocol attacks are cleaned in the data center's or protection provider's network before the traffic reaches the server.
• Proxy and protected CDN: visitors connect to the protection network rather than directly to your server; the network inspects requests and forwards only clean traffic. Keeping the server's real IP address hidden is important.
• Rate limiting: the number of requests one source can make in a given time is limited.
• WAF (web application firewall): blocks malicious request patterns.
• Challenges: suspicious clients are asked to pass a browser check, filtering out bots.

What to Check When Choosing a DDoS-Protected Server

1. Which layers are protected? Network-level (L3/L4) protection alone may not stop L7 attacks on websites. Ask separately about L7 protection for web projects.
2. Is protection always on? Protection that only kicks in after an attack starts can lead to short outages.
3. Clean traffic charges: find out whether extra traffic fees apply during an attack.
4. Game servers: web protection may not suit UDP-based game traffic; ask the provider how it protects game traffic.
5. Support: know in advance whom to contact, and how, during an attack.

Measures You Can Take Yourself

• Don't expose the server's real IP address in DNS records or email headers.
• Close the ports you don't use with a firewall.
• Configure connection and request limits on the web server.
• Use caching to reduce the load heavy pages put on the server.
• Prepare a short response plan for what to do during an attack.

ViHyper Hyper DDoS Guard

Hyper DDoS Guard is a service designed to protect websites against attacks targeting the application layer (Layer 7). Your site is placed behind a protected CDN and proxy network; traffic is filtered there and clean traffic is forwarded to your server. Plans include caching and flood protection; higher plans add rate limiting, private tunnelling, a WAF and a load balancer. At the time of writing, plans start at ₺5,950.37 per month.

On the server side, the protection scope of VDS and data center plans is stated on the plan pages.

Frequently Asked Questions

Does a DDoS attack steal my data?

The aim of DDoS is to disrupt the service, not to steal data. However, some attackers use DDoS to distract from another attack, so keep an eye on your security logs too.

How long does a DDoS attack last?

Anything from a few minutes to days, depending on the attacker's goal and resources.

Does a CDN like Cloudflare stop DDoS completely?

It provides strong protection for web traffic, but if the server's real IP address is known, the attacker can bypass the CDN and target the server directly. IP privacy and server-side filtering are needed too.

Is launching a DDoS attack a crime?

Yes. Blocking or disrupting access to a system is a crime under the Turkish Criminal Code and the laws of most countries; you cannot attack someone else's system in the name of a "stress test".