What is a DDoS attack and how to stop it

What is a DDoS attack?

A DDoS (Distributed Denial of Service) attack floods a server, website, or network with more traffic than it can handle, until legitimate users can no longer reach it. The traffic arrives from many sources at once, often thousands of compromised devices in a botnet, which is why "distributed" is in the name. Solid DDoS protection is now a basic requirement for any service that needs to stay online, from an online shop to an API or a game server.

Common types of DDoS attacks

• Volumetric floods: UDP, ICMP, or DNS amplification that saturate your bandwidth (measured in Gbps).
• Protocol attacks: SYN floods and similar, which exhaust connection tables on firewalls and load balancers (measured in packets per second).
• Application layer (Layer 7): floods of HTTP GET/POST requests that look almost like real users and target expensive pages, search, or login.

How to tell you are under attack

Sudden latency, timeouts, or a spike in traffic with no marketing reason are the first signs. On a Linux server you can inspect live connections:

# count connections per client IP
ss -ntu state established | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

# watch inbound traffic on the interface
watch -n1 'cat /proc/net/dev'

If one or a few addresses hold hundreds of connections, or requests hammer a single URL, you are likely dealing with an attack rather than organic load.

How to stop a DDoS attack

1. Filter obvious sources at the firewall

Block or rate limit abusive addresses while you investigate:

# drop a single abusive source
iptables -A INPUT -s 203.0.113.10 -j DROP

# limit new connections per source on port 443
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 50 -j DROP

2. Rate limit at the web server

For Layer 7 floods, nginx can cap requests per client:

limit_req_zone $binary_remote_addr zone=web:10m rate=10r/s;
server {
    location / {
        limit_req zone=web burst=20 nodelay;
    }
}

3. Ban repeat offenders automatically

Fail2ban reads your logs and blocks addresses that cross a threshold, which helps against slow application floods that stay under raw traffic limits.

4. Move filtering upstream

The hard truth: a large volumetric attack fills your uplink before your server ever sees a packet, so local rules cannot help. That traffic must be filtered before it reaches you, at the network edge. This is what dedicated DDoS protection and traffic scrubbing do: clean the traffic upstream, forward only legitimate requests, and keep your bandwidth free.

How CloudHosting handles DDoS protection

Services in our Riga data centre, and our Netherlands and Dubai locations, sit behind network level DDoS filtering with BGP based scrubbing for volumetric events. Our 24/7 team monitors traffic and can tune mitigation for your specific application, under NIS2 and GDPR aligned operations with EU data sovereignty.

Practical takeaway

Handle small floods yourself with firewall rules, nginx rate limiting, and fail2ban, but do not rely on the server alone. Anything large has to be stopped upstream, so put real DDoS protection in front of any service you cannot afford to lose, and keep monitoring so you notice the attack in minutes, not hours.