Learn / Attack archive / Lesson 30
Floods and botnets — DDoS
How hijacked TVs and routers now send 31 terabits a second, how one quirk in HTTP/2 let a small botnet do the work of a huge one, and why the defence lives in front of your server.
Last updated: 2026-09-23
What it is
A denial-of-service attack does not steal anything. It sends so much traffic, or such expensive traffic, that real visitors cannot get through. A distributed one (DDoS) sends it from thousands or millions of machines at once, so blocking one address does nothing.
Those machines are a botnet: devices infected with malware and rented out. Today they are mostly cheap internet-connected things that are never updated: routers, cameras, digital video recorders and Android TV boxes.
There are two broad kinds:
- Volume floods fill the pipe. Measured in bits per second.
- Application floods send requests that look real and are expensive to answer, like searches or logins. Measured in requests per second. They need far less traffic to hurt.
Why it is a rule
- HTTP/2 Rapid Reset, October 2023. HTTP/2 lets a browser open a request and then cancel it. Attackers found they could open and cancel requests as fast as the network allowed. The server did the work of starting each one; the attacker paid almost nothing. Google saw a peak of 398 million requests per second, and Cloudflare traced its own record peak to a botnet of only about 20,000 machines. Google, Cloudflare and AWS disclosed it together as CVE-2023-44487 and every major web server shipped a fix.
- MadeYouReset, August 2025. Researchers found a way to make the server cancel the requests instead, getting around many Rapid Reset fixes (CVE-2025-8671). Web servers again issued patches.
- Aisuru, 2025. A botnet built largely from hacked routers, cameras and Android TV boxes set record after record. Cloudflare reported a 29.7 terabit-per-second attack in the third quarter, then 31.4 terabits per second in December 2025. The 31.4 Tbps attack lasted 35 seconds. Short bursts like that are over before a human can react.
Why it keeps working
- Insecure devices are everywhere. Millions of devices ship with default passwords and never get updates.
- Protocols have cheap-to-send, costly-to-answer features. Rapid Reset is one; so is any unauthenticated search, login or export.
- Botnets are for hire. A flood can be rented by the hour.
- Your server cannot outgrow it. No single server has 31 terabits of bandwidth.
How to do it
1. Put a large network in front
Volume floods can only be absorbed by a provider with more capacity than the attacker: a CDN or DDoS protection service. Your server's address should not be public, or the attacker will go around the shield.
2. Make expensive requests cost the caller
- Rate-limit per IP and per account, with tighter limits on search, login and export routes.
- Cache every page that is the same for everyone, so a flood of them never reaches your code.
- Cap request body sizes and how long a request may run.
app.use(express.json({ limit: '100kb' }))
server.headersTimeout = 10_000
server.requestTimeout = 30_0003. Keep the web server patched
Rapid Reset and MadeYouReset were fixed in the server software, not in anyone's application code. Nginx, Node, Apache, Envoy and others all had releases.
4. Degrade on purpose
Decide in advance what to switch off under load: search, exports, heavy reports. A site that keeps working in a smaller form is better than one that falls over.
5. Do not become part of a botnet
Change default passwords on every router and camera you own, and replace devices that no longer get updates.
How we do it here
The site sits behind a CDN, and pages that are the same for every visitor are served from the edge, so a flood of them does not reach our server. Every request passes a per-IP rate limiter, request bodies are capped, and the limiter's own memory is bounded so it cannot be flooded itself. See Size and rate limits and Edge caching.
Benefits
- A CDN absorbs volume no single server ever could.
- Edge caching makes the most common flood, repeated page loads, almost free.
- Rate limits and timeouts protect against small, clever floods as well as big, dumb ones.
Disadvantages
- DDoS protection depends on a third party, and its outages become yours.
- Rate limits can block real users who share an IP, such as a school or office.
- Application floods that look exactly like real users are hard to tell apart from success.
Checklist
- A CDN or DDoS protection service is in front of the site.
- The origin server's address is not published.
- Expensive routes have their own tighter limits.
- Request sizes and durations are capped.
- The web server and runtime are patched against known HTTP/2 flaws.
- There is a plan for what to switch off under load.