# DoS vs DDoS Attacks: What's the Difference?

> DoS vs DDoS: a DoS attack floods a target from one source, a DDoS from thousands of botnet devices. Compare scale, tracing, blocking, and defenses.

**The difference between a DoS and a DDoS attack is the number of sources: a DoS (Denial of Service) attack floods a target from a single machine, while a DDoS (Distributed Denial of Service) attack floods it from many machines at once: usually a botnet of compromised devices.** Both aim to make a service unavailable, but the distributed version is larger, harder to trace, and far harder to block.

| | DoS | DDoS |
|---|---|---|
| **Traffic source** | One machine or connection | Hundreds to thousands of devices (a botnet) |
| **Scale** | Limited to one host's bandwidth and compute | Aggregate capacity of every device in the botnet |
| **Tracing** | Single source IP: straightforward to identify | Many distributed, often spoofed IPs |
| **Blocking** | A firewall rule on one IP often stops it | Needs rate limiting, scrubbing services, or CDN absorption |
| **Complexity** | Low (one script, one origin | Higher) coordinated, often multi-vector campaigns |

![DDoS vs DoS illustration](/images/cms/68deb2eeec4d8c3511f85e51_img-7pe3rdek8qir2nbgdcsno0kh.png)

## Quick Takeaways

- DoS = one attacking source; DDoS = many sources attacking simultaneously, typically via a botnet.
- A DoS attack can usually be stopped by blocking a single IP; a DDoS attack cannot.
- DDoS attacks fall into volumetric, protocol, and application-layer categories, and campaigns often mix them.
- Fast detection relies on baselining normal traffic and alerting on spikes, error rates, and unusual geographic patterns.
- The first hour of response matters most: filter traffic, engage your ISP or mitigation provider, and preserve logs.
- Prevention is layered: hardened perimeter, redundancy, CDNs, rate limiting, and a tested incident response plan.

## What is a DoS attack?

A DoS (Denial of Service) attack is an attempt to make a machine or network resource unavailable by overwhelming it with traffic or malformed requests from a single origin. Attackers typically use one computer or script to exhaust server resources: CPU, memory, connection tables, or bandwidth. Classic DoS variants include buffer overflow exploits, [SYN floods](/learning/threats), ICMP floods, and teardrop attacks. For small sites and legacy systems, even a single-source attack can cause hours or days of downtime.

## What is a DDoS attack?

A DDoS (Distributed Denial of Service) attack uses many compromised devices to flood a target simultaneously. Attackers first build [botnets](/learning/threats) (networks of infected computers, servers, and IoT devices) then direct all of them at one victim. Because the traffic arrives from many unrelated IP addresses, distinguishing attack traffic from legitimate users becomes the central challenge, and simple source-blocking stops working.

## How do DoS and DDoS attacks differ technically?

The main technical difference is the number of sources, and everything else follows from it. A DoS attack comes from one IP, so it's simpler to trace and can often be blocked at the [firewall](/learning/what-is-a-firewall). A DDoS attack leverages distributed resources to overwhelm total capacity, can combine multiple attack vectors at once, and resists IP-based blocking because there are too many sources, many of them spoofed. Detecting a DDoS requires correlating logs across edge devices, load balancers, and application servers, and stopping one usually requires third-party mitigation capacity to absorb or filter the flood.

![Side-by-side comparison of single-source DoS attacks and distributed botnet-driven DDoS attacks.](/images/figures/how-do-ddos-and-dos-attacks-differ-and-defend-fig1.webp "1200x533")
*The core difference: one source versus many, and how that changes tracing and blocking.*

## Which is more dangerous: DoS or DDoS?

DDoS attacks are more dangerous for most organizations because they scale beyond what any single defense point can handle and are much harder to attribute. A DoS attack is bounded by one machine's capacity; a DDoS attack multiplies that by every device in the botnet. DDoS campaigns also sustain longer, adapt mid-attack by switching vectors, and are cheap to rent as a service, which is why they account for the large outages that make headlines. That said, a well-aimed DoS against a fragile legacy system can still take a small business offline, so neither should be ignored.

## What are common DDoS attack types?

Three widely observed categories cover most attacks, and campaigns often combine them:

- **Volumetric attacks** saturate bandwidth using UDP floods or amplification techniques that bounce traffic off open servers to multiply its size.
- **Protocol attacks** (like SYN floods) exhaust connection state on servers, firewalls, and load balancers rather than raw bandwidth.
- **Application-layer attacks** target web servers and APIs with legitimate-looking requests that are cheap to send but expensive to process.

Attackers mix methods to bypass single-layer defenses, which is why effective protection has to be layered too.

## How can you detect a DoS or DDoS attack quickly?

Look for sudden traffic spikes, growing error rates, slower responses, and unusual geographic source patterns. These are the fastest indicators. Configure monitoring to alert on deviations from baseline traffic and on sustained connection attempts. Rate-limiting counters, connection tracking, and anomaly detection (including an [intrusion prevention system](/learning/threats)) catch early signs. Correlate logs from edge devices, load balancers, and application servers for a clear picture. Early detection is the single biggest factor in reducing outage time.

## What immediate steps should you take during an attack?

Protect critical systems first: divert or filter traffic, enable rate limits, and apply access control lists where practical. Notify your ISP and any DDoS mitigation provider immediately so traffic scrubbing or rerouting can start. Maintain clear internal communication, and preserve logs for post-incident analysis and any legal follow-up. If attacks cause significant financial loss or come with extortion demands, involve law enforcement, preserved logs and ransom communications support the investigation. Predefined incident-response playbooks beat ad-hoc decisions; speed and coordination in the first hour matter most.

![Four-step incident response flow for the first hour of a DoS or DDoS attack.](/images/figures/how-do-ddos-and-dos-attacks-differ-and-defend-fig2.webp "1200x699")
*Speed and coordination in the first hour matter most.*

## What preventive steps reduce DoS and DDoS risk?

Layered preparation is what separates a blip from an outage:

- **Harden the perimeter:** patch firmware and software, close unused ports, and segment critical services.
- **Remove single points of failure:** redundant architecture, CDNs, and load balancers spread the load an attack must overcome.
- **Limit exposure:** rate limiting, strict ACLs, and geo-restrictions where they fit your traffic.
- **Contract mitigation before you need it:** scrubbing services can absorb volumetric floods far larger than your own capacity.
- **Test the plan:** run tabletop exercises at least annually and after major infrastructure changes, including your third-party providers, so handoffs work under pressure.

## How should small businesses approach DDoS protection?

Small businesses should prioritize the basics: firewall rules, rate limiting, and a reputable CDN or managed security service in front of customer-facing systems. Many managed providers offer mitigation that costs little during normal operation and scales during attacks. Establish an escalation path with your hosting provider or ISP before an incident, and add DNS failover and regular backups for resilience. For MSPs, DDoS readiness sits naturally alongside email security in a layered client defense, Palisade's [Email Security Score](/tools/email-security-score) is a quick way to assess the email side of that posture, and our [domain reputation tool](/tools/domain-reputation) helps confirm a client's infrastructure isn't quietly participating in someone else's botnet.

## Common issues with DoS and DDoS mitigation

### Why is legitimate traffic getting blocked while I'm mitigating?

Over-aggressive rules are usually the cause: a rate limit set below real peak demand, or a geo-block that catches genuine customers. Tune thresholds against your measured baseline rather than a round number, allowlist known-good sources (payment processors, monitoring, your own offices), and prefer a challenge (such as a JavaScript or CAPTCHA check) over an outright drop so real users can still get through. Watch error rates as you tighten, and back off the moment legitimate requests start failing.

### Why didn't my firewall stop the attack?

A traditional firewall tracks connection state, and volumetric or protocol floods are designed to exhaust exactly that: the connection table fills, or the upstream link saturates, before the firewall can help. Worse, the flood often congests your internet circuit ahead of any device you control. The fix is to move filtering upstream: a CDN or a scrubbing service absorbs and cleans traffic before it reaches your link, which is why on-premise rules alone can't stop a large distributed attack.

### Why does blocking the source IPs not end the attack?

Because a [DDoS](/learning/threats) arrives from thousands of hosts, many with spoofed addresses. Blocking them one by one is whack-a-mole, and you'll often block real users who share an address range. Switch from IP blocklists to behavioral filtering, connection rate limiting, and scrubbing that scores traffic on how it behaves rather than where it comes from. IP blocking only reliably works against a single-source DoS.

### Why is my service still degraded after the flood stops?

Lingering exhaustion. Connection tables, worker pools, and application queues can stay saturated after the traffic drops, and auto-scaled capacity may take time to settle. Flush or recycle connection state on affected servers, confirm no slow application-layer requests are still tying up workers, and scale resources back down gradually while you watch latency return to baseline. Preserve the logs before you recycle anything. They matter for the post-incident review.

## Frequently asked questions

### Can a single device cause a major outage?

Yes. A misconfigured or powerful single-host DoS can overwhelm weak infrastructure, causing extended downtime. However, modern DDoS attacks scale using botnets and are more commonly responsible for large outages.

### Will blocking IP addresses stop a DDoS?

Blocking individual IPs helps with small attacks but is ineffective against distributed attacks that use thousands of IPs or spoofed addresses. Use behavioral filtering, rate limiting, and scrubbing services for better protection.

### Are IoT devices often used in DDoS attacks?

Yes. Poorly secured IoT devices are frequently recruited into botnets and can produce large volumes of traffic during DDoS campaigns. Hardening IoT devices and applying network segmentation reduces this risk.

### How much does DDoS protection cost?

Costs vary widely: basic CDN or managed protection can be affordable for small businesses, while enterprise-grade scrubbing services charge based on capacity and service levels. Evaluate needs against risk and recovery objectives to find the right balance.

### Can DDoS attacks be completely prevented?

No. You cannot guarantee prevention, but you can greatly reduce impact with layered defenses, monitoring, and tested incident response. Preparation shortens outages and lowers recovery costs.

## Related reading

- [How do zombie botnets hijack devices, and why should IT teams care?](/learning/threats)
- [How does a SYN packet work and why should security teams care?](/learning/threats)
- [What is a firewall?](/learning/what-is-a-firewall)