If you're new to this, read what a DDoS attack is first. This page is about concrete DDoS attack examples, grouped by the layer they target. Everything here is explained for defenders.
| Attack | Layer | Goal | Primary defence |
|---|---|---|---|
| UDP flood | L3/L4 | Saturate bandwidth | Upstream volumetric mitigation |
| DNS / NTP amplification | L3/L4 | Saturate bandwidth | Amplification guard |
| SYN flood | L4 | Exhaust connection table | SYN proxy / cookies |
| ICMP flood | L3 | Consume bandwidth and CPU | ICMP control |
| IP fragment attack | L3 | Exhaust reassembly | Fragment filter |
| HTTP flood | L7 | Exhaust web app | Per-source limits, caching |
| Game query flood | L7 | Overload game server | Query caching, protocol validators |
| Connection exhaustion | L4/L7 | Fill service slots | Per-source connection limits |
Volumetric DDoS attack examples
1. UDP flood
The attacker sends huge volumes of UDP packets, often to random ports, with spoofed source addresses. UDP has no handshake, so the target can't easily tell good from bad. The result is a saturated link. Stopped upstream by inline volumetric mitigation.
2. DNS and NTP amplification
A reflection attack: tiny requests are sent to open DNS or NTP servers with the victim's IP forged as the sender. The servers answer the victim with responses many times bigger than the request. Filtering reflected responses at the edge stops them reaching you.
Protocol DDoS attack examples
3. SYN flood
Floods a server with TCP SYN packets and never completes the handshake, leaving half-open connections until the table is full. A SYN proxy or SYN cookies complete handshakes on the server's behalf, so only real clients get through.
4. ICMP (ping) flood
Masses of ICMP echo requests chew bandwidth and CPU. Control or disable ping at the network edge.
5. IP fragmentation attack
Malformed or overlapping fragments force the target to burn resources reassembling packets that never make sense. Dropped by a fragment filter.
Application-layer DDoS attack examples
6. HTTP flood
Thousands of seemingly valid GET or POST requests aimed at expensive pages like search or login. Bandwidth use is low but the application falls over. Mitigated with per-source limits, caching and SYN proxy for the web port.
7. Game server query flood
Spamming a game server's query port (such as Steam A2S queries) or sending forged handshakes to exhaust its resources, which causes lag for everyone. Defended with protocol validators and query caching, so floods are answered from a cached reply. See game server DDoS protection.
8. Connection exhaustion
Opening as many SSH, RDP or database connections as possible to fill the service's slots. Handled with per-source connection limits and closing services you don't use.
Real attacks mix techniques. Multi-vector attacks combine volumetric floods with application-layer probing, which is why layered defence matters. Our prevention checklist shows how to build it.
FAQ
What is the most common type of DDoS attack?
UDP floods and reflection/amplification attacks, because UDP is connectionless and easy to spoof.
What is a reflection attack?
The attacker spoofs the victim's IP and sends requests to third-party servers, which send their replies to the victim. Amplification makes those replies much larger than the requests.
Which layer do DDoS attacks target?
Network (L3), transport (L4) or application (L7). Volumetric attacks mostly hit L3/L4, while HTTP and game query floods target L7.
Keep reading
Stop attacks before they reach your server.
Add Glitch Guard to a Glitch Servers VPS, dedicated server or game server and manage every rule from the client area.