DDoS (Distributed Denial of Service)

A distributed denial of service (DDoS) attack uses many compromised or rented machines to overwhelm a target so real users cannot get through. Because the traffic comes from thousands of addresses, you cannot simply block one source.

Why it matters

A DDoS attack looks like an outage from the outside: pages time out, return 503, or load slowly. Knowing the attack type tells you where to defend. Attacks fall into three broad groups:

• Volumetric (UDP floods, amplification): saturate your bandwidth.
• Protocol (SYN floods): exhaust connection tables on servers and firewalls.
• Application layer (HTTP floods): send many legitimate-looking requests to expensive pages such as search or login.

Example

During an HTTP flood you might see one URL receive thousands of requests per second from many IPs. A first containment step at the proxy:

limit_req_zone $binary_remote_addr zone=search:10m rate=5r/s;
location /search { limit_req zone=search burst=10 nodelay; }

This helps against small floods only. Large volumetric attacks must be absorbed upstream by a provider with more bandwidth than the attack, since your own server's link fills before software sees the traffic.

Common mistakes

• Planning to handle volumetric attacks on the origin server. Your hosting link is the bottleneck.
• Exposing the origin IP behind a CDN, which lets attackers bypass protection.
• Having no baseline of normal traffic, so you cannot tell an attack from a viral post.
• Confusing a DDoS with a plain traffic spike or a failed deploy before checking logs.

Related

• WAF
• Rate limiting
• Anycast
• गाइड: DDoS basics for website owners
• टूल: Outage root cause finder

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.