What Is a DDoS Attack? How It Works and What SMBs Can Do

Updated: October 2026

The website is down, the office internet crawls, and nothing in the server logs looks broken. That could be a bad deploy or a provider outage. It could also be a DDoS attack, and here's how one works, how it reaches a small business, and what you can do about it.

TL;DR

• A DDoS attack floods a target with traffic from thousands of machines at once. The goal is to make a website, service or connection unusable, not to break in.
• There are three kinds. Volumetric attacks fill the pipe, protocol attacks exhaust firewalls and servers, and application-layer attacks bury a website in requests that look normal.
• Most attacks are small and short. Cloudflare's Q2 2025 report found 94% of network-layer attacks stayed under 500 Mbps. That is still enough to take down an office line or a small website.
• A small business can't absorb an attack alone. The defence lives upstream: a CDN or WAF in front of the website, the ISP for the office connection, the cloud provider for cloud workloads.
• Write the runbook before you need it. Who to call, what to switch on, what logs to keep, and a rule to never pay a ransom demand.

What Is a DDoS Attack?

DDoS stands for distributed denial of service. A denial-of-service attack tries to make something unavailable by overwhelming it. The "distributed" part means the traffic comes from many machines at once, not one.

A single attacker on one connection is easy to block. You find the address and drop it. A distributed attack comes from thousands or millions of addresses spread across the world, and each one sends only a small share. Blocking one changes nothing.

The attacker doesn't need to break in. They don't steal data or install anything on your network. They make you unreachable, and the damage is the downtime: a checkout that won't load, a VPN nobody can connect to, a support line that depends on a dead internet link.

That's also why a DDoS attack often gets mistaken for an ordinary outage at first. Nothing is hacked, so nothing looks hacked.

DoS vs DDoS: Why One Source Is Easy and a Million Aren't

A plain DoS attack comes from one machine or one connection. It can still hurt, especially if it exploits a bug that crashes a service with a handful of packets. But the fix is usually quick: identify the source address, block it at the firewall or with the provider, and patch the bug.

A DDoS attack removes that option. The traffic arrives from so many addresses that no blocklist keeps up, and many of those addresses belong to real homes and offices whose devices were hijacked. Blocking them all would block real visitors too. The defence has to recognise attack traffic by its pattern, not its source, and it has to do it somewhere with more capacity than the flood. That's why the answer is almost always a provider, not a setting on your own equipment.

Where the Attack Traffic Comes From

The machines sending the traffic are usually a botnet: devices infected with malware and controlled remotely. Their owners rarely know.

Cheap connected devices make the best recruits. In October 2016, CISA warned about Mirai, malware that infected home routers, network cameras and video recorders by trying a list of 62 common default usernames and passwords. One Mirai attack on a security journalist's site exceeded 620 Gbps. The source code was then published online, and copies have been running ever since.

The pattern hasn't changed, only the scale. Cloudflare traced the largest attack it recorded in 2025 to the Aisuru-Kimwolf botnet, made up mostly of infected Android TVs, with an estimated 1 to 4 million hosts.

Nobody needs their own botnet to launch an attack. DDoS-for-hire services, often sold as "booters" or "stressers", rent attack capacity by the hour. That's why the targets include small businesses with no obvious enemies: a disgruntled customer or a competitor can rent an afternoon of downtime without any technical skill.

The Three Types of DDoS Attacks

CISA, the FBI and MS-ISAC group DDoS attacks into three categories in their March 2024 guidance. Each one exhausts something different, so each one needs a different defence.

PowerCert walks through how these floods take a site down, with the three layers side by side:

Volumetric attacks try to fill your connection. If your office line is 500 Mbps and 2 Gbps arrives, legitimate traffic can't get in, no matter how well your firewall is configured. Amplification makes these cheap. The attacker sends small requests to open DNS or NTP servers with your address forged as the sender, and those servers send much larger replies to you.

Protocol attacks go after the devices that keep track of connections. A SYN flood opens thousands of half-finished TCP handshakes and never completes them. A stateful firewall remembers every one of those half-open connections, and its state table fills up long before the line is full.

Application-layer attacks look like real visitors. Each request is a normal page load or login attempt, just millions of them. They're small in bandwidth and hard to spot, and they target the most expensive pages: search, login, checkout. In October 2023, Cloudflare reported an attack that abused a flaw in HTTP/2 (CVE-2023-44487, "Rapid Reset") and peaked just above 201 million requests per second, from a botnet of about 20,000 machines.

How Big DDoS Attacks Got in 2025

Cloudflare publishes quarterly DDoS reports from the traffic it blocks, and its February 2026 report covered all of 2025. It counted 47.1 million DDoS attacks in the year, up 121% on 2024.

The largest reached 31.4 terabits per second and lasted 35 seconds. Short is typical. Cloudflare's own summary from mid-2025 is that "most DDoS attacks are short in duration, even the largest and most intense ones."

The record-breakers aren't what hits a small business, though. In the same Q2 2025 report, 94% of network-layer attacks stayed under 500 Mbps. That sounds modest until you compare it with the connection in a typical office. A few hundred megabits is enough to saturate a small business line, and a burst of a few minutes is enough to drop every call and VPN session on it.

How a DDoS Attack Hits a Small Business

A small business can be the target, the collateral, or the customer of someone else's outage. The four paths look different when they happen.

The website or web app. This is the classic target: the marketing site, the online store, the client portal. Application-layer floods are cheap to aim at a single URL, and a small web server gives out quickly. This r/StopBadBots post from a US company describes 15 to 20 attacks in 10 days on a marketing site that was already behind a CDN, and the trade-off of turning on the strictest mode, which also blocked the search crawlers the site depends on.

The office connection. An attack on the office's public IP fills the line, and phones, VPN, cloud apps and card terminals all go with it. Anything exposed directly to the internet invites this, which is one more reason to think twice about port forwarding services from the office network.

Someone else's outage. When a SaaS platform, a payment provider or the ISP itself is under attack, the business is down too and can do nothing about it. The planning question here is continuity, not mitigation: what staff do when the tool they depend on is unreachable.

Ransom DDoS. Some attacks come with a note: pay, or the next wave is bigger. Cloudflare reported that around a third of the customers it surveyed in June 2025 had been threatened or hit by a ransom DDoS attack. Of the respondents who knew who attacked them, 63% pointed to competitors.

Signs You're Under a DDoS Attack

A DDoS attack and a normal outage can look the same from inside. A few signs point to an attack:

• Traffic spikes sharply with no campaign, launch or news to explain it.
• Requests arrive from far more addresses and countries than your real visitors ever do.
• One URL, often login or search, gets hammered while the rest of the site stays quiet.
• The firewall's CPU or connection table is at its limit while the internet line is only partly used.
• The line is full, but no device on the inside is generating the traffic.
• The problem stops and starts in bursts of a few minutes.

Your CDN or hosting dashboard will usually show the first three before anyone opens a ticket. For the office line, the ISP can see what's arriving at its edge, which you can't.

What a Small Business Can Do About DDoS

The defence against a DDoS attack sits upstream of you, with providers whose networks are big enough to absorb the flood. The job for a small IT team is to put those providers in place before an attack and know who to call during one.

Put the website behind a CDN or WAF with DDoS protection. This is the single most effective step for anything public-facing. Then lock the origin server so it only accepts traffic from the CDN's addresses. Otherwise attackers find the real IP and go around the protection. Learn the provider's "under attack" settings in advance, including what they do to search crawlers.

Ask the ISP what's included. Many ISPs filter attacks against their own network as a matter of course, because an attack on one customer hurts the rest. Some sell scrubbing as an add-on. This r/sysadmin thread is the typical conversation: an ISP quoted $250 a month for DDoS protection, and the replies range from "your primary ISP may already do this for free" to "if you're under attack, it's worth it."

Before you pay, ask four questions. What is filtered by default? Does mitigation filter the bad traffic, or does it blackhole your IP and take you offline anyway? How fast does it start, automatically or after a phone call? Is there a 24/7 number that reaches someone who can act?

Use the cloud provider's protection. Workloads in public clouds get a baseline for free. AWS documents that all customers get Shield Standard "at no additional charge," covering common network and transport layer attacks. Paid tiers add application-layer protection and response support.

Shrink what's exposed. Every service reachable from the internet on the office IP is a target. Move remote access to a VPN or zero-trust gateway, close forwarded ports nobody uses, and keep the firewall's connection limits sensible.

Keep a second path. A backup internet line from a different provider keeps phones and cloud apps running if the main link is flooded or the ISP has its own bad day.

A Short DDoS Runbook

When an attack starts, minutes matter and nobody wants to look up a phone number. A one-page runbook covers it:

1. Confirm it's an attack. Check the CDN or hosting dashboard and ask the ISP what they see on your line. Rule out a bad deploy or a provider outage.
2. Call the provider that can act. The ISP for the office line, the CDN or host for the website. Have the account numbers and the 24/7 contact on the page.
3. Switch on the stronger settings. The CDN's attack mode, stricter rate limits on the targeted URL, geo-restrictions if all your real traffic is local.
4. Tell people what's happening. Staff need to know the outage is external and what to use instead. Customers need a status update, not silence.
5. Keep the evidence. Save CDN and firewall logs, timestamps and any ransom note. If there's a ransom demand, report it to the FBI's IC3.
6. Review afterwards. Note what worked, how long each step took, and what to change. Fold it into your wider incident response plan.

Worked Example: A Ransom DDoS on a Small Office

Here's how the runbook plays out, as an illustrative example. A 40-person accounting firm has a 500 Mbps fibre line, a client portal hosted with a web host, and phones that run over the internet.

On a Tuesday morning the office manager gets an email: pay a sum in cryptocurrency by Friday, or the firm goes offline during tax week. Twenty minutes later, calls start dropping and the client portal times out.

The IT lead opens the runbook. The host's dashboard shows the portal is fine, so the problem is the office line. The ISP's support desk confirms a flood of UDP traffic at around 2 Gbps, four times the size of the line, aimed at the office IP. They switch on the scrubbing service included in the business plan, and within half an hour the line is usable again.

Meanwhile, staff move urgent calls to mobiles, as the runbook says, and the ransom email goes to the FBI's IC3 with the headers intact. Nobody pays.

On Thursday a second wave hits the client portal instead. That one fails too, because the week before, the firm had moved the portal behind a CDN and locked the origin to the CDN's addresses.

What saved the week was preparation. Every step, from the ISP contact to the fallback for phones, was written down before anyone needed it.

What Not to Do During a DDoS Attack

A few instincts make things worse.

Don't pay the ransom. Payment marks you as a business that pays, and it doesn't stop the next group with a booter subscription. Report the demand instead.

Don't try to scale your way out. A bigger server or a larger VM won't absorb traffic that fills the line before it reaches you. Restarting services doesn't help either; the flood is still there when they come back.

Don't rely on the office firewall. It sits behind the internet line. If the line is full, the firewall never sees the traffic it would need to block, and state-table floods target the firewall itself.

Don't block whole regions without checking. Geo-blocking can help against a noisy source, but it also cuts off customers, partners, remote staff and search engine crawlers. Check your real traffic first.

Don't leave the origin exposed. If the website's real IP address is public, the attacker skips the CDN. Rotate the address if it has leaked, and firewall the origin to the CDN's ranges.

DDoS Attacks, in Short

A DDoS attack is traffic, not a break-in: thousands of hijacked devices sending more than your website or connection can handle. For a small business, the fix is upstream. Put the website behind a CDN, know what your ISP filters, use the cloud provider's protection, and keep a one-page runbook with the numbers to call.

For the network side, see how a stateful firewall tracks connections and where it runs out of room.