---
title: "Comment by Damiano Bianda on \"Denial of Service (DoS) & Distributed Denial of Service (DDoS): How Attacks Work and How We Defend Against Them\" | Hashnode"
description: "Solid primer. Two distinctions that matter a lot once you move from reading about DDoS to actually defending against it. First, volumetric vs application-layer:"
url: "https://hashnode.com/posts/denial-of-service-dos-distributed-denial-of-service-ddos-how-attacks-work-and-how-we-defend-against-them/6af0f1bc3d98ae9959f8cdad/comment/6af199877f00aa502ff1944f"
---

[Discussion](https://hashnode.com/posts/denial-of-service-dos-distributed-denial-of-service-ddos-how-attacks-work-and-how-we-defend-against-them/6af0f1bc3d98ae9959f8cdad)

Comment [Denial of Service (DoS) & Distributed Denial of Service (DDoS): How Attacks Work and How We Defend Against Them](https://hashnode.com/posts/denial-of-service-dos-distributed-denial-of-service-ddos-how-attacks-work-and-how-we-defend-against-them/6af0f1bc3d98ae9959f8cdad)

[Damiano Bianda](https://hashnode.com/@damianobianda)

[2d ago](https://hashnode.com/posts/denial-of-service-dos-distributed-denial-of-service-ddos-how-attacks-work-and-how-we-defend-against-them/6af0f1bc3d98ae9959f8cdad/comment/6af199877f00aa502ff1944f)

Solid primer. Two distinctions that matter a lot once you move from reading about DDoS to actually defending against it. First, volumetric vs application-layer: a 2 Tbps amplification attack (memcached, CLDAP, NTP reflectors) and a 50k req/s HTTP flood against your login endpoint are both called "DDoS" but share almost nothing - the first is a bandwidth problem that only upstream scrubbing or anycast absorption can solve, the second is a compute problem that rate limiting, caching, and bot management at your own edge can address. Defenses that work for one are useless for the other. Second, why "just block the IPs" fails: the source addresses in amplification attacks are spoofed, and the reflectors are innocent third parties - blocking them means blocking real users' resolvers and servers. And the botnet-driven floods rotate through tens of thousands of residential IPs that look like your customers. The practical layering is: anycast/scrubbing for volume, rate limits and connection budgets for application floods, and - the one people skip - an upstream contact and a playbook ready before the attack, because negotiating with your transit provider mid-incident is the worst time to meet them.

[Ved Patel](https://hashnode.com/@vedhp)

[21h ago](https://hashnode.com/posts/denial-of-service-dos-distributed-denial-of-service-ddos-how-attacks-work-and-how-we-defend-against-them/6af0f1bc3d98ae9959f8cdad/comment/6af199877f00aa502ff1944f#reply-6af35d0466275041f76c70a5)

Thanks for adding this! I like your point about why simply blocking IP addresses isn't enough. I focused on the different types of DoS/DDoS attacks and the general defensive tools in my article, but your explanation highlights how much the mitigation strategy depends on the type of attack. The distinction between bandwidth exhaustion and application-layer resource exhaustion is interesting. Definitely some useful points for me to explore further. Appreciate you sharing this!