Quick answer: A DDoS (Distributed Denial of Service) attack floods a server or its network link with traffic from many sources at once so legitimate users cannot get through. Attacks target bandwidth (volumetric), network stacks (protocol) or applications (Layer 7) — and each layer needs a different defense.
Overview
Unlike a hack, DDoS does not break in — it drowns you. Traffic comes from botnets of thousands of compromised devices, which is why blocking single IPs barely helps. Understanding the three classes matters because host firewalls only address a slice of the problem; volumetric floods must be filtered upstream, before your port.
Before you start
- Volumetric: UDP/amplification floods measured in Gbps that saturate the network link itself.
- Protocol: SYN floods and similar tricks that exhaust connection tables on servers and middleboxes.
- Layer 7: seemingly legitimate HTTP requests in overwhelming volume, aimed at expensive endpoints (search, login, cart).
Step-by-step guide
How to recognize what is hitting you:
- Site slow or unreachable, but SSH from another network works? Check connection counts:
ss -sand per-IP spread (identify suspicious traffic). - Thousands of half-open connections in
SYN-RECV→ protocol attack; enable SYN cookies (default on modern kernels). - Access logs full of fast repeated requests to one URL from many IPs → Layer 7; add rate limits and caching in front of the app.
- Everything times out including ping, and traffic graphs spike → volumetric; a host cannot fix this — filtering must happen upstream (Cloud2Y DDoS protection).
Common issues
- Confusing DDoS with load: a traffic spike after a promo looks similar — check whether requests come from real user patterns or repetitive bot signatures.
- Blocking IPs one by one: useless against botnets; use rate limits, caching and upstream filtering instead.
- Null-routing yourself: aggressive local rules can cut legitimate users along with the flood.
When to contact support
If the attack saturates your uplink or persists despite application-level mitigation, report it to Cloud2Y — network-level filtering and the DDoS protection option are handled on our side.
Frequently asked questions
How is DDoS different from hacking?
A DDoS attack does not break into your server — it overwhelms it or its network link with traffic from thousands of sources so legitimate visitors cannot get through.
Why can't I just block the attacking IP addresses?
Botnet traffic comes from thousands of constantly changing addresses, so per-IP bans never catch up. Rate limiting, caching and upstream filtering are the effective tools.
Can a firewall on my VPS stop a DDoS attack?
It helps against small application-level floods, but volumetric attacks saturate the uplink before packets reach your rules — that layer must be filtered upstream by the provider.
Related articles
- Cloud2Y DDoS protection overview
- How to report a DDoS attack
- DDoS basics and mitigation options
- How to protect an API or web app
Need a hand? Contact Cloud2Y support →
