What Are the Types of DDoS Attack? Volumetric, Protocol and Application Layer

Millions of packets can be sent in one DDoS attack.

In another, the application can become unusable at a far lower traffic volume.

One attack fills the internet link while another exhausts the connection table on the firewall.

A third targets the web application's login, search or API services directly.

For that reason the statement:

“We were hit by a DDoS attack.”

is not technically sufficient on its own.

The real question to ask is this:

Which type of DDoS attack are we facing, and which layer of the infrastructure is it targeting?

Classifying attacks correctly is extremely important in corporate DDoS security. Because volumetric DDoS, protocol DDoS and application layer DDoS attacks target different resources and can require different defence mechanisms.

In general, DDoS attacks can be examined in three basic categories:

Volumetric Attacks

Protocol Attacks

Application Layer Attacks

In addition to these, reflection, amplification, multi-vector DDoS, DNS floods and botnet-based attacks make the modern DDoS threat landscape more complex still.

What matters for the organisation is not only the size of the attack traffic.

Which resource the attack consumes and at which point it can interrupt the service matters more.

What Are the Types of DDoS Attack?

DDoS attacks are divided into categories according to the method used and the resource targeted.

The most common classification is as follows:

Volumetric DDoS

Tries to consume the bandwidth of the target or its internet service provider.

Protocol DDoS

Targets network and transport layer resources.

Application Layer DDoS

Targets the resources of the application itself.

Along with these;

Layer 3 – Network Layer

Layer 4 – Transport Layer

Layer 7 – Application Layer

are terms frequently used in DDoS security.

But attacks do not always have to stay within a single category.

In modern attacks several DDoS vectors can be used at the same time.

This approach is called a multi-vector DDoS attack.

What Is a Volumetric DDoS Attack?

A volumetric DDoS attack aims to consume the available bandwidth of the target system or connection by generating large amounts of traffic.

In these attacks the aim is generally to consume the network capacity rather than the target system's processor.

Say the organisation's internet connection has:

2 Gbps

of capacity.

When the traffic the attacker generates climbs far above that, the organisation's connection can reach saturation.

In that case, even if the;

firewall,

WAF,

web server,

application server

are all running, real users may not be able to reach the service.

In volumetric DDoS attacks, therefore, one of the most important defensive points can be the upstream network ahead of the organisation's own data centre.

How Is Volumetric DDoS Measured?

One of the metrics frequently used in volumetric attacks is:

Bits Per Second (bps)

as a value.

In practice it can be expressed as;

Mbps,

Gbps,

Tbps.

But looking only at the Gbps figure when assessing DDoS capacity is wrong.

At the same time;

Packets Per Second (PPS)

and in some cases;

Connections Per Second (CPS)

matter too.

Because two attacks using the same bandwidth can place completely different loads on network devices.

In professional DDoS resilience testing, therefore:

bandwidth + PPS + CPS

must be assessed together.

What Is a UDP Flood?

A UDP flood is one of the common volumetric and network-level DDoS attacks.

UDP is a protocol that requires no connection establishment.

Because of that characteristic, large numbers of packets can be generated.

During a UDP flood, heavy UDP traffic can be directed at the target system or at particular ports.

This can affect;

the internet connection,

firewall packet processing capacity,

network devices,

the target server.

The important point for the defence is this:

It may not be possible to block all UDP traffic in an organisation.

Because legitimate services such as;

DNS,

VoIP,

VPN,

streaming

use UDP.

It is therefore important that the DDoS mitigation mechanism can distinguish legitimate UDP traffic from attack traffic.

What Is an ICMP Flood?

An ICMP flood is a DoS/DDoS approach based on sending large volumes of ICMP packets to the target system.

ICMP is necessary for normal network operations.

Some mechanisms used during network troubleshooting, for example, rely on ICMP.

But heavy, malicious traffic can consume;

network resources,

bandwidth,

packet processing capacity.

Here again the basic security principle emerges:

A protocol being legitimate does not mean it cannot be abused.

What Is Reflection DDoS?

A reflection attack is the approach in which the attacker directs traffic at the target using third-party systems rather than sending it directly.

The basic logic is as follows:

The attacker sends a request to a third-party service.

But they spoof the source IP address to look like the target's IP address.

The third-party service sends the response not to the attacker but to the target system.

The attacker can therefore use different internet services as traffic reflectors.

The sources of the attack traffic may consequently not point directly at the attacker's real infrastructure.

What Is Amplification DDoS?

An amplification attack is the attacker's attempt to direct a larger volume of responses at the target by sending a small volume of requests.

For example:

The request the attacker sends may be small.

But the response the service produces may be far larger.

This difference can be assessed as the amplification factor.

The method helps the attacker create a traffic impact greater than their own capacity.

Reflection and amplification techniques are often used together.

What Is a DNS Amplification Attack?

DNS amplification is one of the best-known reflection/amplification examples in the DDoS world.

By abusing certain characteristics of DNS infrastructure, small queries can be made to produce larger responses.

When source IP spoofing is used, DNS responses can be sent to the victim system rather than the attacker.

Carried out across a large number of systems, this method can generate serious traffic.

From a DNS security perspective, organisations must assess not only their own DNS servers but also the service architecture in the outside world.

Concepts such as;

authoritative DNS,

recursive DNS,

DNS redundancy,

anycast DNS

matter particularly for DDoS resilience.

What Is NTP Amplification?

Network Time Protocol (NTP) is an important protocol used for time synchronisation between systems.

In the past, misconfigured or abusable NTP services have been used in amplification attacks.

This example shows an important point in DDoS security:

The protocol the attacker targets does not have to be a service the organisation itself provides.

Third-party infrastructure on the internet can be used to magnify the attack.

Various other UDP-based services have likewise been used historically in reflection/amplification attacks.

What Is a Protocol DDoS Attack?

A protocol DDoS attack refers to attacks targeting the way network and transport layer protocols work.

In these attacks the aim may not be merely to fill the internet link.

The target may be limited resources such as;

the firewall connection table,

the load balancer,

the server TCP stack,

the NAT table,

the state table.

A protocol attack can therefore cause a service outage without generating very high Gbps figures.

What Is a SYN Flood?

A SYN flood is one of the best-known layer 4 DDoS attacks.

A TCP connection normally uses a three-stage handshake process:

SYN → SYN/ACK → ACK

The client sends a connection request.

The server responds.

The client completes the connection.

In a SYN flood attack, large numbers of connections are initiated with the aim of never completing them.

The server or network device may allocate resources for these half-open connections.

When large numbers of connections build up, pressure can form on;

the connection table,

memory,

the network stack.

The result is that real users find it harder to establish new connections.

Why Does SYN Flood Still Matter?

Modern operating systems and security devices include various protections against SYN floods.

But the impact of the attack depends on factors such as;

volume,

PPS,

firewall capacity,

load balancer capacity,

server configuration.

The attacker also does not have to use a single technique.

A SYN flood can be applied alongside other attack vectors.

It is therefore not enough for an organisation to say:

“Our firewall supports SYN flood protection.”

The real capacity must be verified through controlled DDoS simulations.

What Is an ACK Flood?

An ACK flood is an attack approach based on directing large numbers of TCP ACK packets at the target system or network devices.

The traffic processing capacity of stateful security devices in particular can be targeted.

The firewall has to check whether incoming packets belong to an existing connection.

At high PPS values this can place pressure on device resources.

In layer 4 resilience testing, therefore, not only SYN packets but different TCP flag combinations and network behaviours must be assessed.

What Is a TCP Connection Flood?

In some attacks, rather than half-open connections, large numbers of genuine TCP connections are established.

This can be assessed as a TCP connection flood.

The aim is to consume resources such as;

the concurrent connection limit,

server workers,

the load balancer,

the application connection pool.

These attacks can resemble normal connections more closely.

SYN flood protection alone may therefore not be enough.

What Is the Difference Between Layer 3 and Layer 4 DDoS?

These two concepts are usually used together as L3/L4 DDoS protection.

But technically they refer to different layers.

Layer 3 – Network Layer

Focuses on IP-based network communication.

Layer 4 – Transport Layer

Focuses on transport protocols such as TCP and UDP.

Corporate anti-DDoS solutions generally aim to protect these layers together.

The fundamental aim here is:

filtering attack traffic before it reaches the application.

What Is Application Layer DDoS?

Application layer DDoS refers to attacks targeting services at layer 7 of the OSI model.

These attacks can differ significantly from volumetric DDoS attacks.

The attacker's aim is to exhaust the application rather than fill the internet link.

Components such as;

the web server,

the API,

the authentication service,

the search engine,

the database backend

can be targeted.

A layer 7 DDoS attack can therefore create serious impact even at low bandwidth.

Why Is Layer 7 DDoS Hard to Detect?

Because the attack traffic can resemble genuine user behaviour.

A real user sends:

GET /products

as a request.

A bot can send exactly the same request.

A real user sends:

POST /login

as well.

And the attacker can target the same endpoint.

From a network perspective the packets can be entirely valid.

HTTPS may be in use.

The TCP connection may have been established normally.

The HTTP request may be valid.

The problem lies in the request's purpose, volume and behaviour.

Layer 7 DDoS defence therefore requires behavioural analysis.

What Is an HTTP Flood?

An HTTP flood is a DDoS attack aimed at consuming application resources by sending large numbers of HTTP requests to a web application.

The attack can take place through;

GET,

POST

and other HTTP operations.

But not every URL costs the same on the system.

A static request such as:

/logo.png

consumes very few resources.

But endpoints such as:

/search

/login

/report

/api/query

can trigger additional operations such as;

database queries,

authentication,

backend processing,

external API calls.

From the attacker's perspective it becomes possible to consume more resources with less traffic.

What Are GET Flood and POST Flood?

HTTP flood attacks vary according to the request type used.

GET Flood

Involves sending heavy GET requests to web pages or API endpoints.

POST Flood

Involves concentrating POST requests that perform operations on the server.

Operations such as;

login,

search,

form submission,

API transactions

can be expensive.

DDoS protection must therefore take into account not only requests per second but also the concept of endpoint cost.

What Is API DDoS?

In modern organisations, users no longer receive services only through web pages.

Mobile applications and third-party systems make heavy use of APIs.

API DDoS is therefore an increasingly important risk area.

For example;

the authentication API,

the payment API,

the search API,

the customer API,

the reporting API

can be targeted.

A single API request can trigger many database or microservice operations in the background.

The cost of a small HTTP request on the backend can therefore be very high.

API security and DDoS protection must consequently be handled together.

GraphQL and DDoS Risk

In modern API technologies such as GraphQL, clients can construct more flexible queries.

Without the right security controls, that flexibility can create resource consumption risks.

Complex queries can trigger;

many resolvers,

database queries,

backend operations.

For API resilience, therefore, controls such as;

query complexity limits,

rate limiting,

resource limits,

authentication,

WAF/API protection

are important.

The basic principle here is this:

DDoS protection must understand not only network traffic but also the cost of a request on the application.

What Is a Slow HTTP Attack?

Not every application layer attack has to send large numbers of requests.

Some attacks try to exhaust server resources by holding connections open slowly.

These attacks can generally be assessed in the slow HTTP attack category.

Approaches similar to;

Slowloris,

Slow POST

can target connection resources at low traffic volume.

Detecting DDoS by looking at the bandwidth graph alone is therefore not enough.

What Is a DNS Flood?

DNS services are critical infrastructure for organisations' internet availability.

Even if the web server is running, users cannot reach the service if the DNS service does not respond.

A DNS flood is an attack approach that tries to exhaust service resources by sending heavy queries to the DNS infrastructure.

The target here may be;

DNS server CPU,

query processing,

network capacity,

upstream DNS infrastructure.

DNS must therefore always be assessed separately in corporate DDoS plans.

Are DNS Flood and DNS Amplification the Same Thing?

No.

These two concepts can be confused.

DNS Flood

Targets the DNS service directly with heavy queries.

DNS Amplification

Uses DNS servers to amplify traffic against another target.

In the first, the DNS infrastructure is the direct victim.

In the second, the DNS infrastructure is the reflecting/amplifying part of the attack.

This distinction matters for determining the right mitigation strategy.

What Is a Random Subdomain Attack?

One of the attacks targeting DNS infrastructure is the behaviour called a random subdomain attack, or in some contexts a DNS water torture attack.

The attacker continuously generates queries for different, random subdomains.

For example, names that have not been cached before, such as;

a1.example.com

b928.example.com

random123.example.com

can be used.

The aim may be to create more processing on the recursive or authoritative DNS infrastructure.

These attacks can behave differently from a classic DNS query flood.

What Is Botnet-Based DDoS?

One of the most important structures making DDoS attacks “distributed” is the botnet.

A botnet is a network of many compromised devices controlled by an attacker.

A botnet may contain;

IoT devices,

routers,

servers,

computers.

These systems can be spread across different parts of the world.

That makes it harder to separate attack traffic from genuine user traffic.

Weak security configurations on IoT devices in particular contribute to the formation of large botnets.

What Is Multi-Vector DDoS?

A modern attacker does not have to use a single attack type.

An attack may contain, at the same time;

a UDP flood,

a SYN flood,

an HTTP flood.

This model is called a multi-vector DDoS attack.

The aim is to strain different layers of the defence simultaneously.

While the network team deals with the volumetric attack, the HTTP flood can continue at the application layer.

It is therefore not enough for a DDoS defence to block a single vector.

What Is an Adaptive DDoS Attack?

In more advanced attacks the attacker can change technique according to how the defensive system behaves.

For example;

UDP is filtered.

The attacker switches to TCP.

TCP is limited.

Layer 7 begins.

A particular endpoint is protected.

Another endpoint is targeted.

Dynamic attacks of this kind can be associated with the adaptive or multi-stage DDoS approach.

Automated mitigation and human analysis are therefore both important.

Is Blocking IPs Enough in a DDoS Attack?

In most cases no.

IP blocking can work in an attack coming from a single IP.

But a distributed botnet attack can use thousands of different IPs.

Furthermore, because of structures such as;

NAT,

proxies,

CGNAT,

cloud services,

many genuine users can sit behind a single IP.

Aggressive IP blocking can therefore also block legitimate users.

Modern DDoS protection consequently assesses different signals together, such as;

IP reputation,

behaviour,

rate,

fingerprint,

session,

geolocation,

protocol characteristics.

Does Rate Limiting Block a DDoS Attack?

Rate limiting restricts the number of requests accepted for a particular user, IP, session or endpoint.

It is extremely valuable in application layer DDoS and API security in particular.

While a normal user makes a few login requests per second, a single client sending hundreds of requests is suspicious.

But fixed per-IP rate limiting may not be enough on its own against distributed attacks.

If thousands of bots send requests at a low rate, each can stay below the defined limit.

Distributed low-rate attacks therefore require more advanced behavioural analysis.

Which DDoS Attacks Is a WAF Effective Against?

A web application firewall (WAF) is valuable particularly against HTTP/HTTPS-based layer 7 attacks.

A WAF can assess characteristics such as;

request rate,

URI,

headers,

cookies,

client behaviour,

session patterns.

But if a very high-volume UDP attack fills the organisation's internet link, the traffic may never reach the WAF.

For that reason a WAF is:

an important part of the layer 7 defence.

But:

it is not the whole DDoS defence on its own.

At Which Layer Does Anti-DDoS Work?

Anti-DDoS solutions provide different capabilities depending on the architecture.

They generally include features such as;

volumetric attack mitigation,

L3/L4 filtering,

traffic anomaly detection,

scrubbing.

Some platforms also offer layer 7 protection.

When assessing an anti-DDoS service, therefore, the only question should not be:

“How many Gbps does it support?”

The following must also be assessed;

PPS capacity,

CPS capacity,

layer 7 capabilities,

mitigation time,

scrubbing architecture,

telemetry,

SOC integration.

What Does a CDN Do in a DDoS Attack?

A CDN can reduce the load on the origin system by serving web content from distributed edge infrastructure.

It provides an important advantage for cacheable content in particular.

But if the attacker knows the origin IP they can try to bypass the CDN layer and reach the origin system directly.

For that reason:

Origin Protection

is a critical DDoS security topic.

The origin system should as far as possible accept traffic only from the authorised CDN or reverse proxy infrastructure.

How Is the DDoS Attack Type Identified?

SOC and network teams must assess different telemetry sources during an attack.

For example;

If bandwidth is very high

a volumetric attack is likely.

If PPS is very high but bandwidth is relatively low

a packet flood can be considered.

If the SYN count is rising rapidly

a SYN flood should be investigated.

If the HTTP request count is rising

a layer 7 attack can be assessed.

If a particular endpoint is heavily loaded

it may be application-targeted DDoS.

If DNS query counts are rising abnormally

a DNS flood can be assessed.

But no decision should be made on a single metric.

Which Metrics Should Be Monitored for DDoS?

For corporate DDoS monitoring, at least the following metrics can be assessed:

Bandwidth – Mbps/Gbps

Total traffic on the network.

Packets Per Second (PPS)

Packets per second.

Connections Per Second (CPS)

New connection rate.

Concurrent Connections

Connections open at the same time.

SYN Rate

New TCP connection attempts.

HTTP Requests Per Second (RPS)

Application layer request intensity.

DNS Queries Per Second (QPS)

DNS query intensity.

Application Response Time

The application's response time.

Error Rate

4xx/5xx error rates.

CPU / Memory

Backend resource consumption.

Assessing these metrics together makes it easier to understand which layer the attack is affecting.

How Is a Normal Traffic Increase Distinguished from DDoS?

This question matters particularly in e-commerce, media and campaign periods.

Genuine user traffic can rise suddenly because of;

Black Friday,

a ticket sale,

a product launch,

a news event.

This situation can be called a flash crowd.

A flash crowd and DDoS can look similar from the outside.

Traffic rises in both.

But the behaviour differs.

Real users;

visit different pages,

create normal sessions,

browse products,

log in,

make payments.

Bot traffic, by contrast, shows particular patterns.

Behavioural analysis is therefore critically important for DDoS protection.

Which Is the Most Dangerous Type of DDoS?

There is no single answer to this question.

The most dangerous attack is:

the one that targets the layer where the organisation is weakest.

An organisation may have 100 Gbps of volumetric protection.

But it may lack adequate rate limiting on an expensive API endpoint in the application.

Another organisation may have a strong WAF.

But its internet connection may be low capacity.

A third may have strong network and application protection while its authoritative DNS is served from a single point.

DDoS security must therefore begin not from a product list but from attack surface and bottleneck analysis.

Why Are Different Attack Types Used in DDoS Resilience Testing?

Running a single UDP flood test and saying:

“We passed the DDoS test.”

is not right.

A professional DDoS attack simulation must assess different attack categories in a controlled way according to the organisation's architecture.

Different scenarios can be considered, such as;

volumetric simulation,

UDP flood,

TCP/SYN flood,

connection exhaustion,

HTTP flood,

API load,

DNS query flood.

Each scenario tests a different security control.

Is the Aim of a DDoS Simulation to Crash the System?

No.

The aim of a professional test is not to send as much traffic as possible and crash the system.

The aim is to measure the resilience limits in a controlled way.

The test can start at a low level.

Traffic can be increased in a controlled manner.

At particular thresholds;

latency,

packet loss,

CPU,

firewall sessions,

WAF alerts,

anti-DDoS mitigation,

application response

can be monitored.

Critical thresholds can thereby be identified without causing a service outage.

What Is a Stop Condition in a DDoS Test?

A stop condition is the safety halting condition defined for the test.

For example, the test can be stopped automatically or manually if;

response time exceeds a defined value,

packet loss reaches a critical level,

CPU reaches a particular threshold,

real user experience is affected.

This approach matters particularly for controlled DDoS tests carried out in production environments.

Why Do DDoS Attack Types Matter for Management Too?

Management may not need to know the details of SYN, UDP or HTTP packets.

But understanding this difference is important:

An attack against network capacity

and

an attack against a critical digital application

are not the same risk.

The first may require ISP and anti-DDoS capacity.

The second may require investment in application architecture, WAF and scaling.

Correct attack classification therefore ensures security investment goes to the right area.

How Should Corporate DDoS Defence Be Layered?

The ideal architecture varies by organisation, but the general approach can be thought of as follows:

Internet

↓

Upstream / ISP Protection

↓

Anti-DDoS / Scrubbing

↓

CDN / Edge Security

↓

Firewall

↓

WAF / Bot Protection

↓

Load Balancer

↓

Application / API

↓

Database / Backend

A capacity problem at any point in this chain can cause a service outage.

DDoS resilience is therefore:

only as strong as your weakest bottleneck, not your strongest security layer.

Conclusion: Not Every DDoS Attack Is the Same

DDoS attacks consist of far more than sending enormous traffic at the internet.

An attacker can target;

bandwidth,

packet processing capacity,

the TCP connection table,

the firewall,

DNS,

the web application,

the API,

backend services.

Understanding the type of attack correctly is therefore the first step in DDoS security.

Volumetric DDoS targets bandwidth.

Protocol DDoS consumes network and transport resources.

Application layer DDoS strains the application with requests that resemble genuine user traffic.

Add to these;

reflection,

amplification,

DNS attacks,

botnets,

multi-vector DDoS

and the defence becomes more complex still.

The organisation's core question should therefore not be:

“Do we have an anti-DDoS product?”

The better question is:

“Against the different types of DDoS attack, at which layer, for how long and at what capacity can we hold out?”

The answer to that question should not be guessed.

It should be measured.

And that requires a controlled corporate DDoS attack simulation and DDoS resilience test.

Because a security architecture looking correct on paper and one working under real traffic are not the same thing.