Volumetric floods fill the port, SYN and ACK floods fill state tables, HTTP floods burn application CPU and carpet bombing hides under per-host alarms. A taxonomy by layer, with CISA's amplification factors, Cloudflare's 2025 attack data and the layer of defence that stops each family.
The types of DDoS attacks are easier to reason about when you sort them by what they run out of, not by name. Every flood exhausts one of four things: your port's bandwidth, the packets per second your card and kernel can process, connection-state tables, or your application's CPU. Which one it targets decides which layer of defence can stop it. Below: the families, CISA's amplification table, Cloudflare's 2025 numbers, and what it means when you buy a server.
| Family | Typical vectors | What it exhausts | What stops it |
|---|---|---|---|
| Volumetric, reflection-amplification | UDP floods; DNS, NTP, memcached reflection | Port bandwidth | Upstream scrubbing |
| Protocol, state exhaustion | SYN, ACK, ICMP, fragment floods | Packets per second, state tables | The kernel for small floods, then upstream |
| Application layer | HTTP floods, HTTP/2 Rapid Reset | Application CPU, workers | The application and its proxy, or Layer 7 filtering |
| Carpet bombing (a delivery pattern) | Any of the above, spread thin | Per-target alarm thresholds | Upstream detection across whole ranges |
A defence only acts on traffic that reaches it, so anything that fills your port must be dropped before the port.
Cloudflare's quarterly reports cover only what its own network mitigates, but they are recent:
So filtering has to be in the path before the attack starts; the DDoS protected dedicated server guide compares always-on and on-demand protection.
A volumetric attack sends more bits than the port holds. A 1 Gbps port is full at 1 Gbps whatever your firewall says, and the router in front of it drops the excess, real traffic included.
Reflection makes that cheap. UDP does not validate source addresses, so the attacker sends small requests to public servers with your IP forged as the source, and their larger replies land on you. CISA measures the gain as the bandwidth amplification factor (BAF): reply payload bytes over request payload bytes. A selection from CISA's alert TA14-017A, last revised December 2019 and now archived:
| Protocol | BAF | Typical amplifiers |
|---|---|---|
| Memcached | 10,000 to 51,000 | Caches left open on port 11211 |
| NTP | 556.9 | Unpatched time servers (CVE-2013-5211) |
| CharGEN | 358.8 | A legacy character-generator service |
| CLDAP | 56 to 70 | Exposed directory servers |
| DNS | 28 to 54 | Open resolvers, authoritative servers without rate limits |
| SSDP | 30.8 | UPnP devices answering SEARCH requests |
Redo the sum: 100 Mbps of spoofed queries to NTP amplifiers returns 100 × 556.9 = 55,690 Mbps, over five times a 10 Gbps port. At the top of the memcached range, 1 Mbps of requests becomes 51 Gbps. These are payload ratios; headers make the on-wire ratios lower.
What stops it: something upstream of your port with more capacity than the attack. Reflected traffic is distinctive (replies from source port 123 or 11211 that nobody asked for), and CISA lists stateful UDP inspection among its mitigations. That capacity sits at the provider's edge, on the links peering vs transit describes.
Long term, fewer amplifiers help: BCP 38 (RFC 2827) ingress filtering stops spoofing where deployed, and operators can close unneeded UDP services and rate-limit DNS, as in running your own authoritative DNS server.
These target per-packet processing and connection-state tables, both smaller than the port.
SYN floods. RFC 4987 says a SYN flood does not try to overload the network or the host's memory; it fills the backlog of half-open connections on a listening port. Spoofed SYNs get SYN-ACKs nobody answers, and once the backlog is full, real connections are refused. The host-side answer is SYN cookies: the server encodes the connection in its SYN-ACK's sequence number and stores nothing until a real ACK returns. Linux enables them by default, as a fallback used only when a socket's backlog overflows, since cookies cannot carry some TCP options.
ACK, UDP, ICMP and fragment floods. Packets belonging to no connection still have to be received, looked up and dropped. Behind a stateful firewall, every new flow takes an entry in a table with a fixed maximum (nf_conntrack_max on Linux); spoofed new flows fill it and real connections have nowhere to go. Fragments after the first carry no port numbers, so port rules cannot classify them.
Packets per second is the real unit. A minimum Ethernet frame is 64 bytes plus 20 of preamble and inter-frame gap, so a full 10 Gbps link carries 10,000,000,000 ÷ (84 × 8) ≈ 14.88 million packets per second. With 1,500-byte packets (1,538 on the wire) it carries 10,000,000,000 ÷ (1,538 × 8) ≈ 813,000, about 18 times fewer. Cloudflare's 2025 Q3 peak was 14.1 billion packets per second.
What stops it: the kernel, for floods that fit inside the port and the CPU. Bigger ones must be dropped upstream, before they saturate the card or the port.
An application-layer attack sends requests that look real: full handshakes, valid TLS, plausible URLs. Each costs you a page render, a database query or a worker slot, so the attack needs little bandwidth, and a network-layer filter sees well-formed traffic to port 443 with no reason to drop it. In 2025 Q3, 4 in 100 HTTP attacks Cloudflare saw exceeded 1 million requests per second; a December 2025 campaign peaked at 205 million.
HTTP/2 Rapid Reset (CVE-2023-44487) turned a protocol feature into an attack. A client may cancel a request with a RST_STREAM frame, and a cancelled stream stops counting against the concurrency limit, so a client can open and cancel requests as fast as it can write them while the server works on each. Cloudflare saw a peak just above 201 million requests per second from about 20,000 machines: 201,000,000 ÷ 20,000 ≈ 10,000 each. It was disclosed to web server vendors to patch.
What stops it: the application and the proxy in front of it. Caching makes expensive requests cheap, rate limits cap each client, and patched software closes holes like Rapid Reset. Network filtering helps only if it understands HTTP.
Carpet bombing is a way of delivering any vector: the flood is spread over many destinations, a range of addresses or many ports, so no single target crosses a per-host alarm threshold. The 29.7 Tbps UDP attack in Cloudflare's 2025 Q3 report hit an average of 15,000 destination ports per second, 29.7 Tbps ÷ 15,000 ≈ 2 Gbps per port if spread evenly. Across addresses, 100 Mbps at each of the 256 in a /24 looks quiet on every server and sums to 25.6 Gbps on the shared uplink.
What stops it: detection that adds traffic up across a whole range, which only the network can do; each server sees a slice that looks normal.
Our network page describes AS 25198, our own network; dedicated servers start at the 1 Gbps tier from €209 a month.
Three families plus a delivery pattern. Volumetric and reflection attacks fill your port's bandwidth. Protocol attacks such as SYN floods exhaust packet processing and connection-state tables. Application-layer attacks such as HTTP floods burn your application's CPU. Carpet bombing spreads any of them across many addresses or ports so no single target looks attacked.
The attacker sends small UDP requests to public servers with your address forged as the source, and those servers send much larger replies to you. CISA puts the gain at 28 to 54 for DNS, 556.9 for NTP and up to 51,000 for memcached. The flood comes from many real servers, so blocking one source does nothing.
Only attacks that fit through the port. SYN cookies and firewall rules handle small SYN and packet floods, and rate limits help against modest HTTP floods. Once a flood fills the port, the excess is dropped before it reaches your rules, real traffic included, so volumetric attacks must be filtered upstream.
Usually minutes. In Cloudflare's 2025 Q3 data, 89% of network-layer and 71% of HTTP attacks ended in under 10 minutes, and the 31.4 Tbps record of 2025 lasted 35 seconds. That is too short to switch protection on by hand, so filtering has to be in place first.
When a DDoS attack is bigger than the links it arrives on, hosts null-route the target: every packet to that IP is dropped, legitimate users included. How RTBH (RFC 5635) and the BLACKHOLE community 65535:666 (RFC 7999) work, how to spot one with mtr, and what to ask your host.
A hidden primary, three secondaries in different cities and networks, TSIG-signed NOTIFY and zone transfers, a working Knot DNS config with automatic DNSSEC signing, and the dig commands that prove an authoritative DNS server answers correctly. Plus what it costs and when managed DNS wins.
One UDP port, a dozen lines of configuration and an encryption protocol built into the Linux kernel. From a fresh Ubuntu or Debian server to a working tunnel on a laptop and a phone, including the IPv6 leak most guides miss, split tunnelling, MTU fixes and keeping the server locked down.