---
title: Floods and botnets — DDoS
summary: How hijacked TVs and routers now send 31 terabits a second, how one quirk in HTTP/2 let a small botnet do the work of a huge one, and why the defence lives in front of your server.
topic: attacks
order: 11
updated: 2026-09-23
---

## What it is

A **denial-of-service** attack does not steal anything. It sends so much traffic, or such
expensive traffic, that real visitors cannot get through. A **distributed** one (DDoS) sends it
from thousands or millions of machines at once, so blocking one address does nothing.

Those machines are a **botnet**: devices infected with malware and rented out. Today they are
mostly cheap internet-connected things that are never updated: routers, cameras, digital video
recorders and Android TV boxes.

There are two broad kinds:

- **Volume floods** fill the pipe. Measured in bits per second.
- **Application floods** send requests that look real and are expensive to answer, like
  searches or logins. Measured in requests per second. They need far less traffic to hurt.

## Why it is a rule

- **HTTP/2 Rapid Reset, October 2023.** HTTP/2 lets a browser open a request and then cancel
  it. Attackers found they could open and cancel requests as fast as the network allowed. The
  server did the work of starting each one; the attacker paid almost nothing. Google saw a
  peak of **398 million requests per second**, and Cloudflare traced its own record peak to a
  botnet of only about 20,000 machines.
  Google, Cloudflare and AWS disclosed it together as CVE-2023-44487 and every major web server
  shipped a fix.
- **MadeYouReset, August 2025.** Researchers found a way to make the **server** cancel the
  requests instead, getting around many Rapid Reset fixes (CVE-2025-8671). Web servers again
  issued patches.
- **Aisuru, 2025.** A botnet built largely from hacked routers, cameras and Android TV boxes
  set record after record. Cloudflare reported a 29.7 terabit-per-second attack in the third
  quarter, then **31.4 terabits per second** in December 2025. The 31.4 Tbps attack lasted 35 seconds. Short bursts like that
  are over before a human can react.

### Why it keeps working

- **Insecure devices are everywhere.** Millions of devices ship with default passwords and
  never get updates.
- **Protocols have cheap-to-send, costly-to-answer features.** Rapid Reset is one; so is any
  unauthenticated search, login or export.
- **Botnets are for hire.** A flood can be rented by the hour.
- **Your server cannot outgrow it.** No single server has 31 terabits of bandwidth.

## How to do it

### 1. Put a large network in front

Volume floods can only be absorbed by a provider with more capacity than the attacker: a CDN
or DDoS protection service. Your server's address should not be public, or the attacker will
go around the shield.

### 2. Make expensive requests cost the caller

- Rate-limit per IP and per account, with tighter limits on search, login and export routes.
- Cache every page that is the same for everyone, so a flood of them never reaches your code.
- Cap request body sizes and how long a request may run.

```js
app.use(express.json({ limit: '100kb' }))
server.headersTimeout = 10_000
server.requestTimeout = 30_000
```

### 3. Keep the web server patched

Rapid Reset and MadeYouReset were fixed in the server software, not in anyone's application
code. Nginx, Node, Apache, Envoy and others all had releases.

### 4. Degrade on purpose

Decide in advance what to switch off under load: search, exports, heavy reports. A site that
keeps working in a smaller form is better than one that falls over.

### 5. Do not become part of a botnet

Change default passwords on every router and camera you own, and replace devices that no
longer get updates.

## How we do it here

The site sits behind a CDN, and pages that are the same for every visitor are served from the
edge, so a flood of them does not reach our server. Every request passes a per-IP rate limiter,
request bodies are capped, and the limiter's own memory is bounded so it cannot be flooded
itself. See *Size and rate limits* and *Edge caching*.

## Benefits

- A CDN absorbs volume no single server ever could.
- Edge caching makes the most common flood, repeated page loads, almost free.
- Rate limits and timeouts protect against small, clever floods as well as big, dumb ones.

## Disadvantages

- DDoS protection depends on a third party, and its outages become yours.
- Rate limits can block real users who share an IP, such as a school or office.
- Application floods that look exactly like real users are hard to tell apart from success.

## Checklist

- A CDN or DDoS protection service is in front of the site.
- The origin server's address is not published.
- Expensive routes have their own tighter limits.
- Request sizes and durations are capped.
- The web server and runtime are patched against known HTTP/2 flaws.
- There is a plan for what to switch off under load.

## Sources

- [Cloudflare — 2025 Q4 DDoS threat report](https://blog.cloudflare.com/ddos-threat-report-2025-q4/)
- [Cloudflare — MadeYouReset: an HTTP/2 vulnerability thwarted by Rapid Reset mitigations](https://blog.cloudflare.com/madeyoureset-an-http-2-vulnerability-thwarted-by-rapid-reset-mitigations/)
- [Google Cloud — How it works: the novel HTTP/2 Rapid Reset DDoS attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
- [NVD — CVE-2025-8671](https://nvd.nist.gov/vuln/detail/CVE-2025-8671)
- [Cloudflare Learning — Famous DDoS attacks](https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/)