DDoS is not one attack but a toolbox of techniques, and serious attacks mix several at once. This is a detailed, plain-English tour of the main DDoS attack vectors - what each one does, why it works, and how it is mitigated - so you know exactly what is hitting your server.
Quick answer
The main DDoS attack vectors are UDP floods (raw volume), TCP SYN floods (half-open connections that exhaust connection tables), amplification and reflection attacks that abuse open DNS, NTP or Memcached servers to multiply traffic, and Layer 7 HTTP floods that imitate real visitors. Serious attacks often combine several at once.
First: what is an "attack vector"?
A vector is simply the method an attacker uses to overload you. Each vector abuses a different part of how the internet works - some flood your bandwidth, some exhaust your server's memory, some trick other servers into doing the damage. Understanding them explains why a single firewall rule is never enough. For the high-level split between network and application attacks, see Layer 4 vs Layer 7, and for the terms used throughout, our Anti-DDoS glossary.
UDP floods
UDP is a connectionless protocol - you can fire packets at a server without any handshake, and games rely on it heavily. In a UDP flood, the attacker blasts huge volumes of UDP packets at random or game ports. The server wastes resources checking each one, and the sheer volume saturates the connection. This is the classic, brute-force volumetric attack, and the single most common vector aimed at Minecraft, CS2, Rust and FiveM servers specifically.
Mitigation: drop unwanted UDP at the network edge and at line rate (where XDP shines), allowing only the specific game traffic you expect.
SYN floods
Every TCP connection starts with a three-way handshake (SYN, SYN-ACK, ACK). A SYN flood sends a torrent of SYN requests but never completes them, leaving the server holding thousands of half-open connections until its connection table fills and it can accept no one new - including real players.
Mitigation: SYN cookies and stateless filtering that validate connections without reserving resources for every half-open attempt.
Amplification & reflection attacks
These are the cleverest volumetric attacks. The attacker sends a small request to a public server (DNS, NTP, Memcached) but forges the source address so the large reply is sent to you. A few bytes out becomes kilobytes in - a "reflector" multiplies the attacker's bandwidth dozens or hundreds of times. Memcached reflection has produced some of the largest attacks ever recorded, several of which appear in our list of the biggest DDoS attacks in history.
- DNS amplification - a small query triggers a huge zone response.
- NTP amplification - abusing the old monlist command for a big reply.
- Memcached - extreme amplification factors from exposed servers.
- CLDAP amplification - abuses Active Directory lookup services for large replies from a tiny request.
Mitigation: absorb the volume on a high-capacity network and drop traffic from known reflection sources and ports.
Fragmentation attacks
Networks split large packets into fragments and reassemble them at the other end. A fragmentation attack floods you with malformed or incomplete fragments, forcing the server to burn CPU and memory trying to reassemble packets that will never be whole.
Mitigation: rate-limit and discard abnormal fragments before they reach the host.
Layer-7 (application) attacks
Instead of brute volume, Layer-7 attacks send requests that look legitimate but are expensive to serve - hammering a web panel, a login page or a game's status/query port. They can take a target down with a tiny fraction of the bandwidth a volumetric attack needs, and they are harder to spot because each request looks real.
Mitigation: rate-limiting, behavioural analysis and challenge checks that separate real clients from bots.
pps floods: when packet count matters more than bandwidth
Not every dangerous attack is measured in Gbps. A packets-per-second (pps) flood sends huge numbers of tiny packets - each one individually harmless in bandwidth terms, but expensive for network hardware and the server's network stack to process one by one. A flood that only measures a few hundred Mbps can still knock over a router or a server's NIC if the packet count is high enough. This is one reason line-rate filtering matters as much as raw pipe size.
Why multi-vector attacks are the norm
Real attackers rarely pick one method. A modern attack blends vectors and rotates between them - a UDP flood to fill the pipe, a SYN flood to exhaust connections, a Layer-7 burst against the panel - specifically to defeat defences that only watch one thing.
Defending one vector is like locking one door. Real protection has to cover every door at once, automatically.
That is why effective protection works at multiple layers: a multi-Tbps network to absorb the volume, plus game-aware filtering close to the server. See how it fits together in how our Anti-DDoS works, and how the same techniques scaled up to record size in the biggest attacks of 2025-2026.