DDoS (Distributed Denial of Service) is an attack that sends such a large volume of traffic from many sources (a botnet) that the server cannot process legitimate requests and becomes unavailable.
Attack layers
L3/L4 (network/transport) — UDP/TCP packet flooding. Goal: saturate the channel. Defence: filtering at the provider level
L7 (application) — HTTP flood: thousands of requests to expensive endpoints. Harder to detect because it resembles legitimate traffic
Defence
CDN with DDoS protection — Cloudflare, AWS Shield absorb the attack at edge nodes
Rate Limiting — limit requests per IP
CAPTCHA — for suspicious sessions
Geo-blocking — block regions with anomalous traffic