DDoS Attack Vectors Explained: UDP, SYN, Amplification and More

DDoS is not one attack but a toolbox of techniques, and serious attacks mix several at once. This is a detailed, plain-English tour of the main attack vectors — what each one does, why it works, and how it is mitigated.

First: what is an "attack vector"?

A vector is simply the method an attacker uses to overload you. Each vector abuses a different part of how the internet works — some flood your bandwidth, some exhaust your server's memory, some trick other servers into doing the damage. Understanding them explains why a single firewall rule is never enough. For the high-level split between network and application attacks, see Layer 4 vs Layer 7.

UDP floods

UDP is a connectionless protocol — you can fire packets at a server without any handshake, and games rely on it heavily. In a UDP flood, the attacker blasts huge volumes of UDP packets at random or game ports. The server wastes resources checking each one, and the sheer volume saturates the connection. This is the classic, brute-force volumetric attack.

Mitigation: drop unwanted UDP at the network edge and at line rate (where XDP shines), allowing only the specific game traffic you expect.

SYN floods

Every TCP connection starts with a three-way handshake (SYN, SYN-ACK, ACK). A SYN flood sends a torrent of SYN requests but never completes them, leaving the server holding thousands of half-open connections until its connection table fills and it can accept no one new — including real players.

Mitigation: SYN cookies and stateless filtering that validate connections without reserving resources for every half-open attempt.

Amplification & reflection attacks

These are the cleverest volumetric attacks. The attacker sends a small request to a public server (DNS, NTP, Memcached) but forges the source address so the large reply is sent to you. A few bytes out becomes kilobytes in — a "reflector" multiplies the attacker's bandwidth dozens or hundreds of times. Memcached reflection has produced some of the largest attacks ever recorded.

• DNS amplification — a small query triggers a huge zone response.
• NTP amplification — abusing the old monlist command for a big reply.
• Memcached — extreme amplification factors from exposed servers.

Mitigation: absorb the volume on a high-capacity network and drop traffic from known reflection sources and ports.

Fragmentation attacks

Networks split large packets into fragments and reassemble them at the other end. A fragmentation attack floods you with malformed or incomplete fragments, forcing the server to burn CPU and memory trying to reassemble packets that will never be whole.

Mitigation: rate-limit and discard abnormal fragments before they reach the host.

Layer-7 (application) attacks

Instead of brute volume, Layer-7 attacks send requests that look legitimate but are expensive to serve — hammering a web panel, a login page or a game's status/query port. They can take a target down with a tiny fraction of the bandwidth a volumetric attack needs, and they are harder to spot because each request looks real.

Mitigation: rate-limiting, behavioural analysis and challenge checks that separate real clients from bots.

Why multi-vector attacks are the norm

Real attackers rarely pick one method. A modern attack blends vectors and rotates between them — a UDP flood to fill the pipe, a SYN flood to exhaust connections, a Layer-7 burst against the panel — specifically to defeat defences that only watch one thing.

Defending one vector is like locking one door. Real protection has to cover every door at once, automatically.

That is why effective protection works at multiple layers: a multi-Tbps network to absorb the volume, plus game-aware filtering close to the server. See how it fits together in how our Anti-DDoS works, or skim the terms in our Anti-DDoS glossary.