Types of DDoS Attacks Explained: L3, L4, L7, Amplification & More

By Ingrid Haugen

Performance Marketing Specialists Reviewed by Senior Media Buyers

Published June 10, 2026Updated June 30, 2026

Understanding the different types of DDoS attacks is essential for building effective defences. Each attack type exploits different vulnerabilities, targets different infrastructure layers, and requires different mitigation strategies. An attack that overwhelms your bandwidth requires a completely different response than one that exhausts your web server's connection pool.

This guide breaks down every major DDoS attack category, explains how each works, and maps the specific defences needed to stop them.

DDoS Attack Categories Overview

Volumetric Attacks (Layer 3)

Volumetric attacks aim to consume all available bandwidth between the target and the internet. They generate massive traffic volumes measured in Gbps (gigabits per second) or Tbps (terabits per second).

UDP Flood

Sends a massive number of UDP packets to random ports on the target. The server must check for listening applications on each port and reply with ICMP "destination unreachable" - consuming bandwidth and processing resources. UDP is connectionless, making it easy to spoof source IPs and difficult to filter.

ICMP (Ping) Flood

Sends overwhelming numbers of ICMP echo request (ping) packets. The target must process each request and send echo replies, consuming both bandwidth and CPU. Also known as a "Ping of Death" when using oversized packets.

IP Fragmentation Flood

Sends fragmented IP packets that the target must reassemble. The reassembly process consumes memory and CPU. Overlapping fragments can crash vulnerable systems. Particularly effective against firewalls that must reassemble packets for inspection.

Amplification Attacks

Amplification attacks exploit third-party servers to multiply attack traffic. The attacker sends small requests with a spoofed source IP (the victim's IP) to vulnerable servers. These servers respond with much larger replies directed at the victim.

Protocol Attacks (Layer 4)

Protocol attacks exploit weaknesses in network protocol implementations to exhaust server resources, connection tables, firewalls, load balancers, and session state tracking.

SYN Flood

The most common protocol attack. Exploits the TCP three-way handshake: the attacker sends millions of SYN packets with spoofed source IPs. The server responds with SYN-ACK and waits for the final ACK that never comes. Each half-open connection consumes memory in the server's connection table until it's full, blocking legitimate connections.

ACK Flood

Sends massive volumes of TCP ACK packets. Whilst the server can quickly determine these ACK packets don't belong to any active connection, the processing still consumes CPU. Particularly effective against stateful firewalls that must track every packet against their connection tables.

RST Flood

Sends spoofed TCP RST (reset) packets to terminate active connections between the target and its legitimate users. If the attacker can guess active connection parameters, they can disconnect real users.

TCP Connection Flood

Completes full TCP handshakes, establishing thousands of connections that are never used. Unlike SYN floods, these are complete connections that survive SYN cookie defences. Each connection consumes server memory and file descriptors until limits are reached.

Application-Layer Attacks (Layer 7)

Application-layer attacks are the most sophisticated and hardest to mitigate because each request appears legitimate.

HTTP GET Flood

Sends massive numbers of HTTP GET requests to the target website. Each request is valid HTTP, making it difficult to distinguish from legitimate traffic. Attackers target resource-heavy pages: search pages, product listings, dynamic content that requires database queries.

HTTP POST Flood

Similar to GET floods but uses POST requests, typically targeting login forms, registration endpoints, contact forms, or APIs. POST processing is generally more resource-intensive than GET, making this more efficient per request.

Slowloris

Opens many connections to the target and sends partial HTTP requests very slowly, never completing them. Each connection holds a server thread open indefinitely. With enough slow connections, the server exhausts its connection pool and can't serve new requests. Devastatingly effective against Apache servers.

Slow POST (R.U.D.Y.)

"R U Dead Yet" sends HTTP POST requests with a legitimate Content-Length header but transmits the body data one byte at a time, very slowly. The server keeps the connection open waiting for the complete body, consuming a thread/worker for each slow request.

HTTP/2 Rapid Reset

A newer attack exploiting HTTP/2's stream multiplexing. The attacker opens and immediately resets streams at high speed, forcing the server to process each stream setup and teardown. Discovered in October 2023, it generated the then-largest DDoS attack at 398 million requests per second.

WordPress XML-RPC

Exploits WordPress's pingback feature to amplify L7 attacks. Attackers send pingback requests from thousands of WordPress sites to the victim, creating a distributed L7 flood that appears to come from legitimate WordPress installations.

Multi-Vector Attacks

Modern DDoS attacks rarely use a single vector. Sophisticated attackers combine multiple attack types simultaneously:

• Volumetric + L7: DNS amplification to overwhelm bandwidth whilst HTTP flooding the web server
• SYN flood + Slowloris: Exhaust connection tables whilst holding open remaining connections
• Carpet bombing: Attacking entire IP ranges with varying vectors to bypass per-IP mitigation thresholds
• Pulse attacks: Short, intense bursts that repeatedly trigger and release mitigation, causing instability

Ransom DDoS (RDoS)

RDoS combines DDoS attacks with extortion. Attackers send a ransom demand (usually requesting cryptocurrency) and threaten a sustained DDoS attack if payment isn't made. Some groups demonstrate capability with a short initial attack before demanding payment.

Mitigation by Attack Type

Real-World Attack Examples

Building Comprehensive Protection

No single solution handles all DDoS attack types. Build a layered defence:

1. Network layer: DDoS-protected hosting with anycast network and scrubbing centres for volumetric/protocol attacks
2. CDN/Proxy layer: Cloudflare, Akamai, or AWS Shield to absorb and filter traffic globally
3. Application layer: WAF rules to detect and block L7 attack patterns
4. Bot detection: Bot management with fingerprinting for sophisticated L7 attacks
5. Rate limiting: Intelligent per-IP and per-endpoint throttling
6. Monitoring: Real-time traffic analysis with automated alert escalation