A distributed denial of service attack draws unwanted traffic from many places so blocking one host does not restore service.
Distribution is the point of this page: the load is spread, so a single address ban leaves most of the flood untouched.
How it works
Sources may be compromised devices or other clients acting together, and the combined traffic exhausts bandwidth or the application's ability to answer.
Operators therefore work with upstream networks that can filter closer to the sources, rather than trying to list every address on the suffering server.
The attack is deliberate and many sourced, which separates it from an ordinary outage and from a one source attempt.
Customer notices should describe impact and restoration, not the paths or settings that would help someone aim a similar flood.
Concrete examples
- Blocking the busiest address removes only a small share of errors, and the site stays down until the provider filters upstream.
- A service hosted in one region fails while a standby in another region, announced in advance to the provider, continues to answer.
- Logs show requests from many networks within the same minute, and no single customer network explains the volume.
Protective measures
- Arrange upstream filtering before you need it, and test who is allowed to activate that filtering.
- Do not rely on blocking individual addresses as the primary response to a distributed flood.
- Place critical applications so that a flood of the public site does not remove your ability to operate.
- Report impact and recovery time to users, and keep source details in the private incident record.