What is a DDoS Attack?

A Distributed Denial-of-Service (DDoS) attack floods a target – a server, application, or network – with traffic from many distributed sources at once, exhausting bandwidth, connections, or compute resources until legitimate traffic can no longer get through. Sources are typically compromised devices under an attacker’s control, which makes the flood far harder to block than a single-source attack.

Key takeaways

• DDoS floods a target from many distributed sources to deny service.
• Attacks range from volumetric floods to application-layer request abuse.
• Versa DoS Protection uses Aggregate and Classified profiles to block floods.
• The ddos-threshold alarm reports attacks to Analytics, SNMP, and syslog.
• Concerto’s Threat Detection dashboard tracks DDoS attacks in real time.

On this page: Why it matters · How it works · Types · DDoS & Versa · FAQ

Why are DDoS attacks important?

DDoS is one of the most common and disruptive attacks on internet-connected infrastructure. Attackers don’t need to breach a target’s defenses – they only need to send more traffic than the target, or the links and firewalls in front of it, can absorb. Techniques span port scans, TCP and ICMP floods, host sweeps, and floods of small packets, spread across single or multiple sources, which makes filtering by source address alone ineffective once an attack is distributed.

For businesses, the cost is availability: a successful DDoS attack takes a public-facing service, a branch’s internet link, or an entire data center offline for the attack’s duration, with revenue, support, and reputation impact scaling with downtime. Because SD-WAN branches often carry direct internet access (DIA), an unprotected branch’s LAN and internet circuit are both exposed to floods originating outside the WAN. Detecting and dropping attack traffic automatically, before it saturates the link or exhausts session tables, is what keeps a branch’s real traffic – voice, applications, cloud access – usable during an attack rather than merely surviving it.

What is a DDoS attack?

A denial-of-service (DoS) attack overwhelms a target from a single source; a distributed denial-of-service attack does the same from many sources at once – often thousands of compromised hosts (a botnet) directed at one victim. Distribution is what makes DDoS attacks hard to stop: blocking one source address does nothing when the next thousand keep sending.

Attack traffic takes several forms. Volumetric floods (TCP, UDP, ICMP) saturate available bandwidth with raw packet volume. Port scans and host sweeps probe for open services and reachable addresses, often as reconnaissance ahead of a larger attack. Floods of high-volume small packets target the per-packet processing cost of firewalls, routers, and session tables rather than raw bandwidth, exhausting compute and connection-tracking resources even when bandwidth itself is not the bottleneck. In every case, the objective is the same: consume a finite resource – link capacity, CPU, session slots – faster than the target can process it, so legitimate requests get dropped along with the attack traffic.

Types of DDoS attacks

DDoS attacks generally fall into three categories, often combined in a single campaign. Volumetric attacks – UDP floods, ICMP floods, and reflection/amplification attacks that spoof a victim’s address to trigger oversized replies from third-party servers – aim to consume all available bandwidth on a link or circuit. Protocol (state-exhaustion) attacks – SYN floods, malformed-packet floods, and port scans – target the connection-tracking and processing capacity of firewalls, load balancers, and session tables rather than bandwidth, so a link with plenty of headroom can still go down. Application-layer attacks send requests that look like legitimate traffic – HTTP floods, repeated DNS or TLS-handshake requests – at a rate designed to exhaust a specific application or service, making them harder to distinguish from a genuine traffic spike without deeper inspection. Effective DDoS protection has to cover all three, since an attacker blocked at one layer often shifts to another.

DDoS & Versa

Versa Secure SD-WAN’s DoS Protection is part of the Stateful Firewall (NGFW) feature set and requires the corresponding subscription. Protection is built from two blocks: a DoS profile that defines flood thresholds, and a DoS policy rule that matches traffic by zone, source, destination, IP header, or TCP/UDP service and applies the profile with a Protect action. Profiles come in two types – Aggregate, which monitors thresholds across all matching traffic and suits attacks spread across a wide range of source addresses, and Classified, which tracks thresholds per source-and-destination IP pair and suits attacks aimed at a specific endpoint or narrowed to a few sources. A typical deployment protects a branch’s LAN or direct-internet-access (DIA) circuit from internet-sourced floods.

When a device blocks an attack, the session is tagged with drop-module “ddos” and is visible from the Monitor tab, the CLI, and Versa Analytics under Logs > Threat Detection > DDoS and Dashboard > Security > Threats > DDoS. Concerto’s Security dashboards expose the same per-tenant visibility under Internet Protection > Threat Detection > DDoS. Separately, the ddos-threshold device alarm fires – auto-clearing once traffic drops back below threshold – at Major or Critical severity, sent by default to Analytics, SNMP, and syslog.

Frequently asked questions

What is the difference between DoS and DDoS?

A DoS attack originates from a single source, so blocking that source stops it. A DDoS attack floods the target from many sources at once – often a botnet of compromised devices – so no single block works; mitigation requires threshold- and behavior-based detection instead.

What is the difference between Aggregate and Classified DoS profiles?

An Aggregate profile monitors thresholds across all traffic matching a DoS policy, suited to attacks spread across many source IP addresses targeting a subnet. A Classified profile tracks thresholds per source-and-destination IP pair, suited to attacks aimed at one endpoint or a few sources.

How does Versa detect an active DDoS attack?

Blocked attack sessions are tagged with drop-module “ddos” and visible from the Monitor tab and CLI in near real time. Versa Analytics logs the detail under Logs > Threat Detection > DDoS, and both Analytics and Concerto’s Threat Detection > DDoS tab chart the top attacks.

Does a DDoS alarm clear itself?

Yes. The ddos-threshold device alarm is auto-clearing: it fires when aggregate or classified traffic exceeds its configured threshold, and clears on its own once traffic drops back below that threshold – no manual acknowledgment required, unlike event alarms such as a configuration change.

Can DDoS attacks be fully prevented?

Not entirely – distributed, spoofed, or reflected traffic can’t always be blocked before it reaches a network’s edge. The realistic goal is mitigation: threshold-based profiles and protocol-aware filtering that detect and drop attack traffic fast enough to keep legitimate traffic flowing.

More on DDoS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DDoS, these are worth looking at next.