The three attack families
| Type | What it floods | Classic examples | Measured in |
|---|---|---|---|
| Volumetric | Bandwidth | UDP floods, DNS/NTP amplification | Gbps / Tbps |
| Protocol | Connection state | SYN floods, fragmented packets, Smurf | Packets/sec |
| Application-layer | CPU & app workers | HTTP floods, Slowloris, heavy POSTs | Requests/sec |
Volumetric — drowning the pipe
Attackers bounce small spoofed queries off misconfigured public services (open DNS resolvers, NTP, CLDAP, memcached), which answer the victim with far larger replies — amplification factors of 30× to 500×. These attacks created the multi-terabit records of the past decade.
Protocol — exhausting state tables
SYN floods open thousands of half-finished TCP connections, filling the state tables of firewalls, load balancers and cheap routers — often the first thing to die, long before bandwidth runs out.
Application-layer — pretending to be users
Botnets or servers issue real-looking HTTP requests: logins, searches, checkout flows. Even modest request rates kill dynamic sites because every request costs server work. These are the hardest floods to filter, because the traffic is syntactically legitimate.
Where attack traffic comes from
- Botnets — armies of compromised IoT devices, routers and PCs rented by the hour (the model behind most "stresser/booter" panels — see Imperva's breakdown).
- Rented servers — high-bandwidth machines, used by semi-legitimate "stresser" services.
- Reflection infrastructure — the misconfigured public servers that make amplification possible.
What defenders do
- Anycast absorption — spread traffic across a global edge so no single pipe saturates (Cloudflare, Akamai model).
- Scrubbing — route traffic through filtering centers that drop attack packets upstream.
- Rate limiting & challenges — per-IP request caps, JS challenges for suspicious clients.
- Origin hygiene — hide the real server IP and firewall it to proxy ranges only.
- Runbooks — pre-decided responses: who to call, what to enable, what to sacrifice first.
The legal side
Unauthorized flooding is a crime almost everywhere — US Computer Fraud and Abuse Act, UK Computer Misuse Act §3, EU Directive 2013/40. Enforcement is not theoretical: the FBI seizes for-hire ("stresser") domains in recurring waves — see the DOJ announcements — and both operators and users have been prosecuted.