How DDoS attacks work
1. How DDoS attacks work
OK, let's get started with how DDoS attacks work. A distributed denial-of-service (or DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic from multiple sources. Essentially, it is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. DDoS attacks can come from individuals, cybercriminal groups, or can even be state-sponsored. In the diagram, attackers build networks of infected computers, known as 'botnets', by spreading malicious software through emails, websites and social media. Once infected, these machines can be controlled remotely, without their owners' knowledge and they are then used like an army to launch an attack against any target. Some botnets are millions of machines strong. For context, a large attack in 2017 had a strength of around one terabit per second. For reference, the whole internet has a bisection bandwidth of 200 terabits per second. Now when you compare this to a single Google Data Center, which has a bisection bandwidth of 1,300 terabits per second, you can see, we have internal capacity many times that of any traffic load we can anticipate. This means that when there is an attack, we have time to isolate it and address it. Over the past few years, Google has observed that distributed denial-of-service (DDoS) attacks are increasing in frequency and growing in size exponentially. On June 1, 2022, a Google Cloud Armor customer was targeted with a series of HTTPS DDoS attacks which peaked at 46 million requests per second. This is the largest Layer 7 DDoS attack reported to date—at least 76% larger than the previously reported record. To give a sense of the scale of the attack, that is like receiving all the daily requests to Wikipedia (one of the top 10 trafficked websites in the world) in just 10 seconds. Cloud Armor blocked the attack ensuring the customer's service stayed online and continued serving their end-users. For more details of this attack, a blog article link is included in this module’s course resources.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.