Volumetric DDoS Attack Guide

A volumetric DDoS attack floods your network connection with so much junk traffic that legitimate users can no longer get through. Attackers use botnets and reflection techniques to generate traffic measured in gigabits or terabits per second, saturating your bandwidth until services slow to a crawl or drop offline. These attacks target Layers 3 and 4, and they remain the most common form of DDoS by volume. This guide breaks down how volumetric attacks work, the main types you will face, real examples, and the exact steps to detect and stop them before your uptime pays the price.

Key Takeaways

• A volumetric DDoS attack overwhelms bandwidth with high-volume traffic, measured in bits per second (bps) and packets per second (pps).
• Most volumetric attacks rely on botnets plus reflection or amplification, where a small request triggers a much larger response aimed at the victim.
• Common types include UDP floods, ICMP floods, and DNS, NTP, and memcached amplification, with amplification factors reaching 51,000x.
• Volumetric attacks hit Layers 3 and 4, unlike application-layer (Layer 7) attacks that exhaust server resources with fewer requests.
• Record events have exceeded 3 Tbps, including the 1.35 Tbps GitHub memcached attack in 2018 and multi-terabit attacks reported by AWS, Google, and Cloudflare.
• Effective defense absorbs traffic upstream using a distributed edge, scrubbing, rate limiting, and filtering, not on-premise hardware alone.

What Is a Volumetric DDoS Attack?

A volumetric DDoS attack is a distributed denial-of-service attack that floods a target’s internet connection with massive amounts of traffic, consuming all available bandwidth so real users cannot connect.

The goal is simple: fill the pipe. Every network link has a finite capacity, and once malicious traffic saturates it, legitimate requests get dropped alongside the junk. The server itself may be perfectly healthy while the road to it is gridlocked. Organizations typically rely on DDoS mitigation services that absorb and filter malicious traffic upstream before it reaches their network.

These attacks are measured in throughput, not clever logic. Defenders watch two numbers: bits per second (bps), which shows raw bandwidth consumption, and packets per second (pps), which shows how hard the network gear has to work. High pps can crush routers and firewalls even when total bandwidth looks manageable.

• Targets Layers 3 and 4 (network and transport)
• Measured in bps and pps
• Powered by botnets, often tens of thousands of devices
• Aims to exhaust bandwidth, not application logic

What most teams miss: your origin server can sit at 5% CPU while your site is completely unreachable. The bottleneck is the network path, which is why on-box monitoring often shows nothing wrong.

So if the mechanism is just raw volume, where does all that traffic come from? That starts with the botnet.

How Does a Volumetric DDoS Attack Work?

A volumetric DDoS attack works by commanding a botnet to send or reflect enormous volumes of traffic at a target, often amplifying small requests into much larger responses that saturate the victim’s bandwidth.

The attack usually starts with a botnet, a network of compromised computers, servers, routers, and IoT devices under one attacker’s control. A single command tells thousands of these devices to fire traffic at the same target at once.

Amplification makes it worse. The attacker spoofs the victim’s IP address and sends small queries to open servers such as DNS resolvers or NTP hosts. Those servers reply with responses many times larger, all aimed at the victim. A few bytes out can become tens of thousands of bytes in.

1. Build or rent a botnet of compromised devices.
2. Spoof the victim’s IP address as the source.
3. Send small queries to open reflectors (DNS, NTP, memcached).
4. Reflectors send oversized replies to the victim.
5. The combined flood saturates the target’s bandwidth.

Think of it like mailing postcards with someone else’s return address to thousands of catalog companies. Every heavy catalog lands in their mailbox, not yours. Multiply that across the internet, and you get an amplification attack.

The reason large providers can absorb these floods is architectural: an Anycast network spreads incoming traffic across many global locations, so no single data center takes the full hit. In 2018, attackers abused exposed memcached servers to reflect traffic at GitHub, briefly hitting 1.35 Tbps.

Amplification explains the scale. The next question is which specific techniques attackers reach for most.

Volumetric DDoS Attack Types

The main volumetric DDoS attack types are UDP floods, ICMP floods, and reflection or amplification attacks that abuse DNS, NTP, and memcached servers.

Each type has the same goal: saturate bandwidth, but a different delivery method. Some send raw traffic directly. Others reflect and amplify through third-party servers to multiply their firepower.

For request-based floods, Rate limiting caps how many requests a single source can send in a window, blunting the impact before it reaches your origin.

Memcached amplification is so extreme that one misconfigured server can turn a few megabits into hundreds of gigabits. The fix is not on your side. It is thousands of exposed servers whose admins never firewalled off UDP.

Knowing the types is half the battle. The other half is understanding how volumetric attacks differ from the quieter attacks aimed at your application.

Volumetric vs Non-Volumetric DDoS Attacks

Volumetric DDoS attacks flood bandwidth at Layers 3 and 4 using high traffic volume, while non-volumetric attacks target Layer 7 and exhaust application resources with far fewer, more complex requests.

The distinction matters because the two require different defenses. You cannot filter a terabit flood the same way you filter a slow, low-volume attack on your login page.

Volumetric attacks are loud and show up instantly on bandwidth graphs. Non-volumetric attacks, such as HTTP floods or Slowloris, are quiet and can pass for real users while starving your server of connections.

Layer 7 attacks are best stopped by a web application firewall, which inspects each request and blocks malicious patterns. Layer 3 and 4 floods need Advanced Layer 4 Protection that absorbs and filters traffic before it ever reaches your application.

A SOC team we worked with spent hours tuning application rules during an outage, only to find the real problem was a 40 Gbps UDP flood saturating their uplink. No amount of Layer 7 filtering would have helped.

With the categories clear, it helps to see how big these floods actually get in the real world.

Volumetric DDoS Attack Examples

Notable volumetric DDoS attack examples include the 1.35 Tbps memcached attack on GitHub in 2018, a 2.3 Tbps attack mitigated by AWS in 2020, and multi-terabit attacks later reported by Google and Cloudflare.

These incidents show a clear trend: peak attack volume keeps climbing as attackers find new amplification vectors and larger botnets.

• GitHub, 2018: 1.35 Tbps via memcached reflection, the first widely reported terabit-scale attack.
• AWS, February 2020: 2.3 Tbps using CLDAP reflection, mitigated by AWS Shield.
• Google: disclosed a 2.54 Tbps attack that had peaked back in 2017.
• Cloudflare and others: have since reported floods above 3 Tbps and record packet rates.

The headline is always the terabit number, but the packets-per-second record matters just as much. High pps attacks overwhelm the processing capacity of routers and firewalls, not just the size of the pipe.

Scale like this is frightening on paper. The good news is that detecting a volumetric attack early is very doable once you know the signals.

How to Detect a Volumetric DDoS Attack

You detect a volumetric DDoS attack by monitoring inbound traffic for sudden bandwidth spikes, unusual protocol ratios, and traffic from spoofed or geographically improbable sources.

Speed matters. The faster you confirm a flood, the faster you can route traffic through mitigation. Most delayed responses come from teams that mistake the early spike for a legitimate traffic surge.

• A sudden, sustained jump in inbound bps or pps with no matching business event.
• One protocol, often UDP, suddenly dominating your traffic mix.
• Large volumes of traffic with spoofed or randomized source IPs.
• Uniform packet sizes or repeated payloads across many sources.
• Uplink saturation while origin CPU and memory stay low.

Edge visibility helps. Routing traffic through a secure CDN gives you telemetry and inspection at the network edge, so anomalies surface before they reach your origin.

One e-commerce team caught an attack in under two minutes because their dashboard alerted on a UDP-to-total ratio crossing 70%, long before bandwidth alarms would have fired.

Detection buys you time. What you do with that time, your mitigation strategy, decides whether you stay online.

How to Mitigate Volumetric DDoS Attacks

You mitigate volumetric DDoS attacks by absorbing and filtering traffic upstream through a distributed network, scrubbing malicious packets, rate limiting abusive sources, and spreading load so no single point fails.

On-premise hardware alone cannot stop a terabit flood. If the attack is bigger than your uplink, the fight is already lost at your front door. Effective mitigation happens in the cloud, before traffic reaches you.

1. Absorb traffic across a distributed edge so no single site takes the full load.
2. Scrub inbound traffic to separate malicious packets from legitimate ones.
3. Rate limit and challenge suspicious sources at the edge.
4. Distribute application traffic so a surge never lands on one server.
5. Keep filtering rules current for known amplification ports and vectors.

For Layer 3 and 4 floods, an L4 Gateway filters and forwards only clean transport-layer traffic to your infrastructure. Pair it with load balancing solutions that spread requests across servers, so no single node becomes the choke point during a surge.

Always-on beats on-demand. On-demand mitigation that activates only after detection can still let the first damaging minutes through. Always-on routing absorbs the flood from packet one.

Final Thought On Volumetric DDoS Attack

Volumetric DDoS attacks win by scale, not sophistication. They flood your bandwidth until legitimate traffic has nowhere to go, and no amount of on-box tuning fixes a pipe that is already full. The teams that stay online are the ones that move mitigation upstream, absorbing and filtering traffic long before it reaches their infrastructure.

Treat volumetric defense as a capacity problem first and a filtering problem second. Know your baseline, alert on sudden change, and make sure your traffic can reroute through scrubbing under real load. Detection speed and always-on absorption are what separate a brief blip from a costly outage.

Frequently Asked Questions About Volumetric DDoS Attack