We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
This idea carries a full system design question on its own. Each walks through the full answer.
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 8-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
In February 2018, GitHub experienced the largest DDoS attack ever recorded at the time. 1.35 terabits per second of traffic flooded their servers through amplified memcached reflection. GitHub's entire infrastructure should have buckled. Instead, they were back online within 10 minutes because their traffic was automatically routed through Akamai Prolexic's scrubbing network, which absorbed and filtered the malicious traffic.
That record did not last long. In 2023, Google mitigated an /2 Rapid Reset attack peaking at 398 million requests per second. Cloudflare reported blocking a 71 million RPS L7 attack the same year. AWS Shield has absorbed attacks exceeding 2.3 Tbps.
A DDoS attack does not exploit a vulnerability in your code. It exploits the fundamental constraint that every server has finite capacity. Send enough traffic from thousands or millions of compromised devices (a botnet), and the server cannot distinguish legitimate users from attackers. The server drowns.
DDoS protection is not something you build yourself. It requires absorbing traffic volumes that exceed your infrastructure's capacity, which means the mitigation must happen upstream at the , cloud provider, or dedicated scrubbing service level.
| Layer | Attack Type | Mechanism | Amplification Factor | Mitigation |
|---|---|---|---|---|
| L3/L4 (Network) | SYN flood | Spoofed SYN packets exhaust connection table | 1x (direct) | SYN cookies, upstream scrubbing |
| L3/L4 (Network) | UDP flood | Massive volumes of UDP packets saturate | 1x (direct) | , blackhole routing |
| L3/L4 (Amplification) | reflection | 60-byte query returns 4,000-byte response | 28-54x | BCP38 source validation |
| L3/L4 (Amplification) | NTP reflection | monlist command returns huge response | 556x | Disable monlist, BCP38 |
| L3/L4 (Amplification) | Memcached | 15-byte query returns 750KB response | 51,000x | Disable UDP, firewall port 11211 |
| L7 (Application) | flood | Valid-looking GET/POST requests at massive scale | N/A | WAF, bot detection, CAPTCHA |
| L7 (Application) | Slowloris | Holds connections open with partial headers | N/A | Connection timeouts, reverse |
| L7 (Application) | HTTP/2 Rapid Reset | Opens and immediately resets streams | N/A | HTTP/2 stream limits, patched servers |
Memcached amplification is particularly devastating. The attacker sends a 15-byte UDP packet to an exposed memcached server with the victim's IP spoofed as the source. The memcached server responds with up to 750 kilobytes directed at the victim. That is a 51,000x amplification factor. One laptop with a 1 Mbps upload can generate 51 Gbps of attack traffic.