Key takeaway
Define normal load and critical services, agree on mitigation with providers and test the response path.
How DDoS disrupts service
Volumetric attacks exhaust link bandwidth, protocol attacks exhaust connection-state or packet-processing resources, and application attacks consume resources processing expensive requests. Botnets and open reflectors can generate traffic from many sources. Alongside volume, monitor latency, failed requests and backend resources.
| Attack class | Constrained resource | Planned mitigation |
|---|---|---|
| Volumetric | Upstream bandwidth | Provider upstream filtering |
| Protocol | State or packet processing | Appropriate network mitigation |
| Application | Request and backend resources | Tuned rate limits, WAF and caching; review false positives |
Assess impact and prepare ahead
Inventory critical hostnames, DNS, CDN and network providers, along with business processes that depend on service. Define normal traffic baselines and alert thresholds; prepare contacts, decision authority and customer communications in advance. High availability and load distribution can help, while application-level capacity and dependencies still need review.
Exercise response measures
Know how to activate a provider’s mitigation service, what logs to share and who approves routing changes. Rate limits, WAF rules and caching can reduce application load, but must not block legitimate users. Coordinate exercises with the provider; do not generate traffic that imitates an attack. Local WAF and rate limiting cannot alone recover saturated upstream connectivity; arrange mitigation with the provider before that bottleneck.