# Types of Denial-of-Service (DoS/DDoS) Attacks Explained

> A clear explainer on the categories of denial-of-service attacks: volumetric, protocol and application-layer, plus amplification and reflection techniques and the botnets behind DDoS, and the layered mitigations — rate limiting, upstream scrubbing, CDN and WAF — that absorb them.

Source: https://playciso.com/blog/types-of-dos-attacks · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

---

A denial-of-service (DoS) attack tries to make a system, service or network unavailable to the people who are supposed to use it, by overwhelming it or exhausting a resource it depends on. When the attack comes from many machines at once — usually a botnet — it becomes a distributed denial-of-service (DDoS) attack, and far harder to stop. Understanding the categories is the key to defending against them, because each type needs a different answer. ## DoS versus DDoS A plain DoS attack comes from a single source. A **DDoS** attack comes from many sources simultaneously — typically a botnet of compromised computers, servers, routers and IoT devices scattered across the internet. Distribution is what makes DDoS so dangerous: you cannot block one address to stop it, the traffic looks like it comes from everywhere, and the combined volume can be enormous. Most large-scale denial-of-service activity today is distributed. ## Volumetric attacks: saturate the pipe Volumetric attacks aim to consume the target's network bandwidth with sheer traffic, so legitimate requests cannot get through. The goal is simply to fill the pipe. These are the largest-sounding attacks, and they are frequently built with **amplification and reflection**: - Reflection means the attacker sends requests to third-party services while spoofing the source address to be the victim's, so those services send their responses to the victim — hiding the attacker's origin. - Amplification means choosing third-party services whose responses are many times larger than the request that triggered them, so a small amount of attack traffic turns into a flood. Combined, reflection and amplification let an attacker with modest bandwidth generate a disproportionately large attack aimed at someone else. ## Protocol attacks: exhaust the plumbing Protocol attacks target finite state in servers and network equipment rather than raw bandwidth. The classic example is a flood of half-open connection requests: the attacker starts many connections but never completes them, filling the server's connection-state table until it has no room for legitimate connections. Others abuse the way firewalls, load balancers and other stateful devices track sessions, exhausting their capacity to hold connection state. The hallmark is that a relatively modest amount of traffic can take a service down by exhausting a specific limited resource rather than by overwhelming the link. ## Application-layer attacks: overload the application Application-layer attacks are the subtlest and often the lowest-volume. Instead of flooding the network, they send requests that look legitimate but force the server into expensive work — repeatedly hitting a heavy search query, a report generator, or an authentication endpoint that does costly cryptographic work on every attempt. Because each request resembles a normal one, these attacks are hard to distinguish from real traffic, and a comparatively small number of requests can exhaust the application's processing capacity. Defending them well starts with knowing which endpoints are expensive and exposed, which is exactly the kind of inventory a [threat-modeling exercise](/tools/threat-model) produces. ## Botnets: the engine behind DDoS Most large distributed attacks run on a **botnet**: a network of compromised devices an attacker controls remotely, usually without the owners knowing. The attacker directs thousands of these real, scattered devices to hit one target at once. Because the traffic comes from so many genuine sources, it is extremely hard to separate from legitimate users or to block by origin, and the aggregate firepower is large. This is also why keeping your own devices patched matters beyond your own availability — an unsecured device, like the exposed services discussed in [our SMB ports explainer](/blog/smb-ports-139-445-explained), can be conscripted into someone else's botnet. ## Layered mitigation Because the categories hit different layers, no single control covers them all. Resilient availability comes from combining defenses and, crucially, arranging them _before_ an attack. - Rate limiting and timeouts. At the application, cap how much any single source can demand and set sensible timeouts so slow or incomplete requests cannot pile up. This blunts protocol and application-layer attacks. - Upstream scrubbing and absorbing capacity. Volumetric floods are too big to handle at your own edge, so they are filtered by scrubbing services and absorbed by large upstream capacity you cannot provision in the moment. - A content delivery network. A CDN spreads and soaks traffic across a global edge, both improving performance and giving volumetric attacks a far larger surface to exhaust. - A web application firewall. A WAF filters malicious application-layer requests that look superficially legitimate, which raw bandwidth defenses cannot see. Build the capacity and the provider arrangements ahead of time. Scrambling to add defenses during an active flood rarely works, and availability is a property you have to design for, in the same layered spirit as [defense in depth](/blog/defense-in-depth-explained). ## The takeaway Denial-of-service attacks come in three broad shapes: volumetric floods that saturate bandwidth (often amplified and reflected), protocol attacks that exhaust finite connection state, and application-layer attacks that overload the server with expensive but legitimate-looking requests — most of them delivered at scale by botnets. Because each targets a different layer, you defend with a layered stack: rate limiting, upstream scrubbing, a CDN and a WAF, all arranged before you need them. Match the mitigation to the category and plan capacity ahead, and availability becomes something you can defend rather than something you lose by surprise. ## Frequently asked questions **What are the types of DoS attacks?** Three categories: volumetric (flood bandwidth, often via amplification/reflection), protocol (exhaust finite connection state), and application-layer (expensive, legitimate-looking requests that overload the server). **What is the difference between DoS and DDoS?** DoS comes from a single source; DDoS comes from many at once — typically a botnet — making it far harder to block by source and much larger in volume. **What are amplification and reflection?** Techniques that multiply volumetric attacks: the attacker spoofs the victim's address when querying third-party services, which send large responses to the victim; amplification picks services whose responses dwarf the request. **What is a botnet?** A network of compromised devices an attacker controls remotely, directed to send traffic at one target simultaneously. It is the engine behind most large DDoS attacks. **How do you mitigate these attacks?** Layer the defenses: rate limiting and timeouts at the application, upstream scrubbing and absorbing capacity for volumetric floods, a CDN to spread traffic, and a WAF for application-layer requests — all arranged before an attack.