Types of DDoS Attacks Explained: L3, L4, L7, Amplification & More
Treat paid media, ad accounts, infrastructure and on page SEO as one operating system rather than four separate vendors. The Unled Network operates the entire stack, ships in 18 locales and replies on Telegram or WhatsApp within 24 hours.
Key Takeaways
- DDoS attacks are categorized into three layers: Volumetric (L3), Protocol (L4), and Application (L7) - each targeting different infrastructure.
- Amplification attacks exploit public servers to multiply traffic by 28x to 51,000x - turning small bandwidth into devastating floods.
- Application-layer (L7) attacks are the hardest to stop because each request looks legitimate - they require bot detection and behavioral analysis.
- Modern attacks are multi-vector: they combine volumetric flooding with protocol exhaustion and L7 attacks simultaneously.
- Each attack type requires different mitigation: anycast networks absorb volume, stateful firewalls block protocol attacks, and bot management + WAF handle L7.
Table of Contents
Understanding the different types of DDoS attacks is essential for building effective defenses. Each attack type exploits different vulnerabilities, targets different infrastructure layers, and requires different mitigation strategies. An attack that overwhelms your bandwidth requires a completely different response than one that exhausts your web server's connection pool.
This guide breaks down every major DDoS attack category, explains how each works, and maps the specific defenses needed to stop them.
The single biggest lever for paid-media performance in 2026 is account hygiene. Aged accounts, clean payment instruments, and isolated browser profiles compound into a 30 to 50 percent CPAiCost Per Acquisition. The price you pay for one conversion (sale, signup, lead).Learn more in glossary → advantage on the same creative.
DDoS Attack Categories Overview
| Category | OSI Layer | Target | Examples | Size |
|---|---|---|---|---|
| Volumetric | Layer 3 | Network bandwidth | UDP flood, ICMP flood | 100 Gbps - 5+ Tbps |
| Amplification | Layer 3/4 | Bandwidth via reflection | DNS, NTP, Memcached amp | 50 Gbps - 3+ Tbps |
| Protocol | Layer 4 | Server/firewall resources | SYN flood, ACK flood | Millions of packets/sec |
| Application | Layer 7 | Web server/application | HTTP flood, Slowloris | Thousands of requests/sec |
Volumetric Attacks (Layer 3)
Volumetric attacks aim to consume all available bandwidth between the target and the internet. They generate massive traffic volumes measured in Gbps (gigabits per second) or Tbps (terabits per second).
UDP Flood
Sends a massive number of UDP packets to random ports on the target. The server must check for listening applications on each port and reply with ICMP "destination unreachable" - consuming bandwidth and processing resources. UDP is connectionless, making it easy to spoof source IPs and difficult to filter.
ICMP (Ping) Flood
Sends overwhelming numbers of ICMP echo request (ping) packets. The target must process each request and send echo replies, consuming both bandwidth and CPU. Also known as a "Ping of Death" when using oversized packets.
IP Fragmentation Flood
Sends fragmented IP packets that the target must reassemble. The reassembly process consumes memory and CPU. Overlapping fragments can crash vulnerable systems. Particularly effective against firewalls that must reassemble packets for inspection.
Amplification Attacks
Amplification attacks exploit third-party servers to multiply attack traffic. The attacker sends small requests with a spoofed source IP (the victim's IP) to vulnerable servers. These servers respond with much larger replies directed at the victim.
| Vector | Amplification Factor | Protocol | How It Works |
|---|---|---|---|
| Memcached | 10,000-51,000x | UDP 11211 | Exploit misconfigured Memcached servers; "stats" command returns massive data |
| NTP | 556x | UDP 123 | "monlist" command returns list of last 600 clients connected |
| DNS | 28-54x | UDP 53 | "ANY" queries against domains with large DNS records |
| SSDP | 30x | UDP 1900 | Exploit Universal Plug and Play (UPnP) devices on the internet |
| CLDAP | 56-70x | UDP 389 | Exploit publicly accessible LDAP servers |
| CharGEN | 358x | UDP 19 | Legacy character generation protocol, sends random characters |
| SNMP | 6.3x | UDP 161 | Exploit publicly accessible SNMP agents |
Protocol Attacks (Layer 4)
Protocol attacks exploit weaknesses in network protocol implementations to exhaust server resources - connection tables, firewalls, load balancers, and session state tracking.
SYN Flood
The most common protocol attack. Exploits the TCP three-way handshake: the attacker sends millions of SYN packets with spoofed source IPs. The server responds with SYN-ACK and waits for the final ACK that never comes. Each half-open connection consumes memory in the server's connection table until it's full, blocking legitimate connections.
ACK Flood
Sends massive volumes of TCP ACK packets. While the server can quickly determine these ACK packets don't belong to any active connection, the processing still consumes CPU. Particularly effective against stateful firewalls that must track every packet against their connection tables.
RST Flood
Sends spoofed TCP RST (reset) packets to terminate active connections between the target and its legitimate users. If the attacker can guess active connection parameters, they can disconnect real users.
TCP Connection Flood
Completes full TCP handshakes, establishing thousands of connections that are never used. Unlike SYN floods, these are complete connections that survive SYN cookie defenses. Each connection consumes server memory and file descriptors until limits are reached.
Application-Layer Attacks (Layer 7)
Application-layer attacks are the most sophisticated and hardest to mitigate because each request appears legitimate.
HTTP GET Flood
Sends massive numbers of HTTP GET requests to the target website. Each request is valid HTTP, making it difficult to distinguish from legitimate traffic. Attackers target resource-heavy pages: search pages, product listings, dynamic content that requires database queries.
HTTP POST Flood
Similar to GET floods but uses POST requests - typically targeting login forms, registration endpoints, contact forms, or APIs. POST processing is generally more resource-intensive than GET, making this more efficient per request.
Slowloris
Opens many connections to the target and sends partial HTTP requests very slowly, never completing them. Each connection holds a server thread open indefinitely. With enough slow connections, the server exhausts its connection pool and can't serve new requests. Devastatingly effective against Apache servers.
Slow POST (R.U.D.Y.)
"R U Dead Yet" - sends HTTP POST requests with a legitimate Content-Length header but transmits the body data one byte at a time, very slowly. The server keeps the connection open waiting for the complete body, consuming a thread/worker for each slow request.
HTTP/2 Rapid Reset
A newer attack exploiting HTTP/2's stream multiplexing. The attacker opens and immediately resets streams at high speed, forcing the server to process each stream setup and teardown. Discovered in October 2023, it generated the then-largest DDoS attack at 398 million requests per second.
WordPress XML-RPC
Exploits WordPress's pingback feature to amplify L7 attacks. Attackers send pingback requests from thousands of WordPress sites to the victim, creating a distributed L7 flood that appears to come from legitimate WordPress installations.
Under DDoS Attack? Get Immediate Protection
Unled Network provides emergency DDoS mitigation with up to 10 Tbps capacity. L3/L4/L7 protection, bot management, and 24/7 incident response for businesses under attack.
Emergency Response →Multi-Vector Attacks
Modern DDoS attacks rarely use a single vector. Sophisticated attackers combine multiple attack types simultaneously:
- Volumetric + L7: DNS amplification to overwhelm bandwidth while HTTP flooding the web server
- SYN flood + Slowloris: Exhaust connection tables while holding open remaining connections
- Carpet bombing: Attacking entire IP ranges with varying vectors to bypass per-IP mitigation thresholds
- Pulse attacks: Short, intense bursts that repeatedly trigger and release mitigation, causing instability
Ransom DDoS (RDoS)
RDoS combines DDoS attacks with extortion. Attackers send a ransom demand (usually requesting cryptocurrency) and threaten a sustained DDoS attack if payment isn't made. Some groups demonstrate capability with a short initial attack before demanding payment.
Mitigation by Attack Type
| Attack Type | Primary Defense | Secondary Defense |
|---|---|---|
| Volumetric (UDP, ICMP) | Anycast network / CDN with massive bandwidth | BGP blackholing (last resort) |
| Amplification (DNS, NTP) | Upstream filtering, scrubbing centers | Block spoofed traffic (BCP38) |
| SYN Flood | SYN cookies, hardware mitigation | Increase backlog, tune kernel params |
| Connection Flood | Connection limits per IP, timeouts | Load balancers with connection mgmt |
| HTTP Flood | Bot management, JS challenges | Rate limiting, WAF rules |
| Slowloris/Slow POST | Reverse proxy (nginx), connection timeouts | Limit concurrent connections per IP |
| HTTP/2 Rapid Reset | Patched HTTP/2 implementations | Rate limit stream creation |
Real-World Attack Examples
| Date | Target/Size | Attack Type | Notable Detail |
|---|---|---|---|
| Oct 2024 | 5.6 Tbps (Cloudflare) | UDP amplification | Largest recorded DDoS attack |
| Oct 2023 | 398M rps (Google/Cloudflare/AWS) | HTTP/2 Rapid Reset | New L7 attack vector discovery |
| Jun 2022 | 26M rps (Cloudflare) | HTTPS flood (botnet) | 5,067 devices generating 212M rps |
| Feb 2020 | 2.3 Tbps (AWS) | CLDAP reflection | Largest recorded at the time |
| Mar 2018 | 1.7 Tbps (Arbor) | Memcached amplification | First major Memcached DDoS |
| Oct 2016 | 1.2 Tbps (Dyn DNS) | Mirai botnet | IoT botnet took down DNS for major sites |
Building Comprehensive Protection
No single solution handles all DDoS attack types. Build a layered defense:
- Network layer: DDoS-protected hosting with anycast network and scrubbing centers for volumetric/protocol attacks
- CDN/Proxy layer: Cloudflare, Akamai, or AWS Shield to absorb and filter traffic globally
- Application layer: WAF rules to detect and block L7 attack patterns
- Bot detection: Bot management with fingerprinting for sophisticated L7 attacks
- Rate limiting: Intelligent per-IP and per-endpoint throttling
- Monitoring: Real-time traffic analysis with automated alert escalation
By The Numbers
How We Compare
Glossary
- CPA
- Cost Per Acquisition. Spend divided by conversions. Primary efficiency metric for performance media.
- ROAS
- Return On Ad Spend. Revenue divided by ad spend, before product cost and overhead.
- CTR
- Click Through Rate. Clicks divided by impressions. Health signal for creative and targeting.
- Conversion Rate
- Visits divided by completed conversion actions. Reflects landing page and offer fit.
- Audience
- Defined population of users a campaign is allowed to bid against.
- Bid Strategy
- Rule the platform follows when deciding the maximum auction bid per impression.
- Quality Score
- Platform composite of expected CTR, ad relevance and landing page experience.
- Frequency
- Average number of times one user is shown the same ad in a window.
- Attribution Window
- Look back period during which a click or view is credited with a conversion.
- Lift Test
- Controlled experiment that measures the actual incremental impact of an ad campaign.
Frequently Asked Questions
How long until types of ddos attacks explained: l3, l4, l7, amplification and more starts producing measurable results?
First measurable signal lands inside seven days when the work is engineered, not improvised. Material lift is consistently visible inside 30 to 60 days. Anyone who promises overnight results is selling vapor or playing with attribution windows.
What does Unled Network deliver differently on types of ddos attacks explained: l3, l4, l7, amplification and more?
We treat types of ddos attacks explained: l3, l4, l7, amplification and more as one operating system, not a checklist. That means a single owner across creative, media, infrastructure and reporting, with a Telegram and WhatsApp response window inside 24 hours, and a 100 percent locale parity across our 18 supported markets.
Is types of ddos attacks explained: l3, l4, l7, amplification and more risky for my account or domain reputation?
Risk only shows up when the work is sloppy. We pre flight every campaign and every page against the relevant policy clause and platform rule. The only meaningful exposure left is platform side instability, which we insulate against with a continuity plan and an aged MCC ready to absorb spend.
Can types of ddos attacks explained: l3, l4, l7, amplification and more work alongside my existing agency or in house team?
Yes. We deliberately staff for hand off. We document every change, ship a shared dashboard, and operate as either the owner of the channel or the technical layer behind your existing team. The model is decided in week one and never re negotiated mid sprint.
Do you offer types of ddos attacks explained: l3, l4, l7, amplification and more in languages other than English?
Yes. Every Unled engagement ships in 18 locales by default with theme, structure and schema parity. We do not run automated translation only. Native review and locale specific examples are part of the standard scope.
How do you measure success on types of ddos attacks explained: l3, l4, l7, amplification and more?
We commit to a single north star metric per engagement, plus three guard rail metrics that protect against vanity wins. Reporting cadence is weekly inside the sprint and monthly at the executive level. Holdout testing is standard whenever the budget supports a clean read.
What information do you need from me to begin?
Read access to the ad accounts and analytics, brand guidelines if any exist, the offer or product the campaign points at, and any prior creative the audience has already seen. We can sign an NDA before any of this changes hands.
What happens if types of ddos attacks explained: l3, l4, l7, amplification and more stops working?
We do not renew engagements that are not generating measurable lift. The model assumes that if the work stops compounding, the diagnosis happens inside the sprint, not after the contract ends. We rebuild from the diagnosis or we recommend you spend the budget elsewhere. Honesty is cheaper than churn.
Enterprise DDoS Protection for Every Attack Type
Our infrastructure handles volumetric, protocol, and application-layer attacks with up to 10 Tbps mitigation capacity. Always-on protection, 24/7 monitoring, and expert incident response.
Telegram: @unlednetwork → WhatsApp Us →
Comments
Have a question or a first-hand experience with this? Join the conversation. Your email is never shown or shared.
We implemented this approach last month and already seeing positive signals. Thanks for the detail.
Thanks for the feedback. You're right that ddos attack types explained can be tricky. We recommend starting with the fundamentals and scaling from there.