A volumetric Distributed Denial-of-Service (DDoS) attack is a cyberattack designed to overwhelm a target’s network infrastructure by flooding it with huge amounts of traffic. Attackers use numerous compromised computers (called a botnet) to produce a volumetric, or large scale, attack, with the goal of completely overwhelming a target system.
By consuming all available bandwidth between the target and the internet, it becomes impossible for legitimate users to access websites, APIs, or services. Think of this like a traffic jam - influxes of vehicles to a single lane road mean no one can get through.
These volumetric attacks are not necessarily intended to exploit software vulnerabilities in the target system - instead, they aim to incapacitate the target so bad actors can access the compromised system.
How does a volumetric attack work?
Volumetric attacks typically use botnets. A botnet is a group of compromised computers or Internet of Things devices (IoT) that are under the control of a hacker (also known as a “botmaster” or “bot herder”). They enable a botmaster to launch large-scale attacks via the pooled computational resources the botnet makes accessible.
Attackers can control these devices remotely and instruct them to send traffic simultaneously to a target.
Because the traffic comes from a huge number of distributed sources, it can be very difficult to block. The massive influx of data saturates network links, routers, and firewalls, preventing legitimate traffic from reaching the destination.
What is the main goal of a volumetric DDoS attack?
The main objective is to exhaust available bandwidth. Every internet connection has a finite capacity, and when incoming malicious traffic exceeds that capacity, legitimate requests are dropped or delayed. Think again about the traffic analogy.
This effectively causes:
Website outages
API failures
Service degradation
Unlike other attack types, volumetric attacks don’t need to actually “break” anything or hack into a system- they simply have to overwhelm resources in order to be effective.
What are common types of volumetric attacks?
Volumetric attacks come in several forms, each designed to generate high traffic volumes:
UDP Floods. Attackers send large numbers of UDP packets to random or specific ports, forcing the target to process and respond to each one.
ICMP (Ping) Floods. Massive numbers of ICMP echo requests (“pings”) are sent to the target, consuming bandwidth and processing power.
Amplification Attacks. These attacks use legitimate third-party servers to multiply traffic volume, making them especially powerful and efficient.
Each method focuses on maximizing traffic output relative to attacker effort.
You can read more in depth about the different types of volumetric and standard DDoS attacks here.
How large can volumetric attacks get?
Modern volumetric attacks can reach hundreds of gigabits per second (Gbps) or even exceed 1 terabit per second (Tbps). Some of the largest recorded attacks have surpassed multiple terabits per second.
To put this in perspective:
A typical enterprise network might handle 1 to 10 Gbps
A Tbps-scale attack is hundreds of times larger
This scale makes volumetric attacks particularly dangerous for organizations without large-scale mitigation infrastructure and security tooling in place.
How are volumetric attacks different from other DDoS attacks?
DDoS attacks are generally divided into three categories:
Volumetric attacks. These focus on overwhelming bandwidth with sheer traffic volume.
Protocol attacks. These target weaknesses in network protocols - an example is SYN floods.
Application-layer attacks. These target specific applications or services - an example is HTTP request floods that mimic real users.
Volumetric attacks are different from other DDoS attacks namely because they use a brute force strategy - rather than using sophisticated or more pointed tactics, they simply send a deluge of traffic at scale and hope for success.
What are the signs of a volumetric DDoS attack?
Organizations can often detect volumetric attacks by observing unusual traffic patterns. Key signs to look out for include:
Sudden and dramatic spikes in inbound traffic
Network congestion or complete service outages
Increased latency and slow response times
Packet loss or dropped connections
Traffic coming from many geographic locations simultaneously
Because the traffic volume is so high, these attacks are often easier to spot compared to other DDoS attack types. Having the right solutions in place that monitor and alert in real time helps keep an organization on top of any sudden changes.
Why are volumetric attacks so effective?
Volumetric attacks are effective because they combine simplicity with scale. They are easy to launch using readily available tools or botnets and are also highly scalable. Since they are difficult to trace due to their distributed nature and attackers often ‘spoof’ the traffic sources, it can be very hard for organizations to identify the source(s) of an attack.
When an attack does happen, it requires enormous resources (both from an infrastructure and personal perspective) to mitigate. Without proper preparation and strategies in place, organizations can really struggle.
Who is typically targeted?
Volumetric DDoS attacks can target virtually any internet-facing service, including:
E-commerce platforms (causing revenue loss)
Financial institutions (disrupting transactions)
Gaming services (impacting user experience)
SaaS platforms and APIs (affecting customers downstream)
Government and critical infrastructure
Attack motivations range from financial gain and extortion to competition, activism, or disruption.
How can organizations defend against volumetric attacks?
Defending against volumetric attacks requires infrastructure capable of handling or absorbing large traffic volumes. Common strategies include:
DDoS mitigation services. Specialized providers use large-scale networks to filter malicious traffic before it reaches the origin.
Traffic scrubbing centers. Incoming traffic is routed through systems that analyze and remove attack traffic.
Anycast networking. Traffic is distributed across multiple global data centers, reducing the impact on any single location.
Rate limiting and filtering. Suspicious traffic patterns can be throttled or blocked.
Scalable infrastructure. Cloud-based systems can dynamically absorb spikes in traffic.
No single solution is enough- effective defense requires a layered security strategy. That is, a strategy that considers multiple methods for detecting and preventing the inevitability of a DDoS attack.
For more information, you can read this ‘Guide to Stopping a DDoS Attack’ here.
Can volumetric DDoS attacks be completely prevented?
It is not possible to completely prevent volumetric attacks, as they originate from external sources on the internet. However, organizations can minimize their impact through preparation.
Effective mitigation focuses on:
Rapid detection
Automated traffic filtering
Scalable infrastructure
Incident response planning
With the right defenses in place, attacks can often be mitigated without noticeable disruption to users.
Why Fastly Is Your Best Solution to Preventing DDoS Attacks
Maintaining comprehensive security against DDoS attacks presents major challenges in terms of cost, complexity, false positives, evolving threats, and resource intensity. However, Fastly's cloud-based DDoS protection solution directly resolves each of these concerns.
The key benefits of Fastly’s DDoS Protection include the following:
Lowers Costs: Fastly offers cost-effective DDoS protection, which is included with its CDN services.
Simplified Complexity: Fastly's solution requires no complex setup or manual tuning on your side. The network automatically absorbs layer 3/4 attacks, while the next-gen WAF seamlessly handles Layer 7 threats.
Reduced False Positives: Fastly's advanced SmartParse detection engine accurately classifies requests while minimizing the false positives that could block real users.
Continuous Evolution: Fastly enhances detection and mitigation based on solid intelligence, letting you stay ahead of evolving global attack trends.
Resource Efficiency: Fastly's massive 336 Tbsp network has a built-in capacity to absorb even extraordinary attacks without performance impacts.
Automated edge mitigation also reduces the origin load.
Sign up for a free trial to learn more about how Fastly can bring you peace of mind and stop bad actors.
You can also read more about available DDoS Mitigation providers here with this detailed guidance.