---
description: This DoS (Denial of Service) Tutorial covers topics like Types of Dos Attacks, How DoS attacks work, DoS Attack Tools, Dos Protection, and more.
title: What is a Denial of Service (DoS) Attack? Definition & Prevention
image: https://www.guru99.com/images/what-is-a-denial-of-service-dos-attack.png
---

[Skip to content](#main)

**⚡ Smart Summary**

Denial of Service (DoS) attacks flood a target such as a web server with more requests than it can handle, denying legitimate users access. This page explains how DoS and DDoS attacks work and how to defend against them.

- 🚫 **Definition:** A DoS attack denies legitimate users access by overwhelming a server, network, or service.
- 🌐 **Scale:** A distributed attack (DDoS) multiplies the flood across a botnet of compromised machines.
- 💥 **Techniques:** Ping of Death, Smurf, Teardrop, SYN flooding, and buffer overflow each abuse a different weakness.
- 🛡️ **Defense:** Security patches, firewalls, router access control lists, and intrusion detection reduce exposure.
- 🤖 **Modern edge:** AI-driven traffic classification now mitigates record-breaking attacks in seconds.
- ⚖️ **Legality:** Attacking systems you do not own is a crime under laws such as the US CFAA.

Read More

![What is a Denial of Service (DoS) Attack](https://www.guru99.com/images/what-is-a-denial-of-service-dos-attack.png)

## What is Denial of Service Attack (DoS)?

DoS is an attack used to deny legitimate users access to a resource such as accessing a website, network, emails, etc. or making it extremely slow. DoS is the acronym for Denial of Service. This type of attack is usually implemented by hitting the target resource such as a web server with too many requests at the same time. This results in the server failing to respond to all the requests. The effect of this can either be crashing the servers or slowing them down.

Cutting off some business from the internet can lead to significant loss of business or money. The internet and [computer networks](https://www.guru99.com/basic-computer-network.html) power a lot of businesses. Some organizations such as payment gateways and e-commerce sites entirely depend on the internet to do business.

In this tutorial, you will learn what a denial of service attack is, how it is performed, and how you can protect against such attacks.

## Types of Denial of Service (DoS) Attacks

There are two types of DoS attacks, namely:

- DoS – this type of attack is performed by a single host.
- Distributed DoS – this type of attack is performed by a number of compromised machines that all target the same victim. It floods the network with data packets.

The diagram below contrasts a single-source DoS with a botnet-driven DDoS.

[![Diagram comparing single-host DoS and distributed DDoS attacks]()](https://www.guru99.com/images/EthicalHacking/DOS_Attacks.jpg)

## How Do DoS Attacks Work?

Let us look at how DoS attacks are performed and the techniques used. We will look at five common types of attacks.

### Ping of Death

The ping command is usually used to test the availability of a network resource. It works by sending small data packets to the network resource. The ping of death takes advantage of this and sends data packets above the maximum limit (65,536 bytes) that [TCP/IP](https://www.guru99.com/tcp-ip-model.html) allows. TCP/IP fragmentation breaks the packets into small chunks that are sent to the server. Since the sent data packages are larger than what the server can handle, the server can freeze, reboot, or crash.

### Smurf

This type of attack uses large amounts of Internet Control Message Protocol (ICMP) ping traffic targeted at an Internet Broadcast Address. The reply IP address is spoofed to that of the intended victim. All the replies are sent to the victim instead of the IP used for the pings. Since a single Internet Broadcast Address can support a maximum of 255 hosts, a smurf attack amplifies a single ping 255 times. The effect of this is slowing down the network to a point where it is impossible to use it.

### Buffer Overflow

A buffer is a temporary storage location in [RAM](https://www.guru99.com/different-types-ram-random-access-memory.html) that is used to hold data so that the CPU can manipulate it before writing it back to the disk. Buffers have a size limit. This type of attack loads the buffer with more data than it can hold. This causes the buffer to overflow and corrupt the data it holds. An example of a buffer overflow is sending emails with file names that have 256 characters.

### Teardrop

This type of attack uses larger data packets. TCP/IP breaks them into fragments that are assembled on the receiving host. The attacker manipulates the packets as they are sent so that they overlap each other. This can cause the intended victim to crash as it tries to re-assemble the packets.

### SYN Attack

SYN is a short form for Synchronize. This type of attack takes advantage of the three-way handshake to establish communication using TCP. A SYN attack works by flooding the victim with incomplete SYN messages. This causes the victim machine to allocate memory resources that are never used and to deny access to legitimate users.

**Don't Miss:**

- [How to Hack a Server (Web)](https://www.guru99.com/how-to-hack-web-server.html)
- [How to See Someone’s Location on an iPhone (6 Methods)](https://www.guru99.com/see-someones-location-on-iphone.html)
- [How Hackers Hack Someone’s Cell Phone Camera?](https://www.guru99.com/how-to-hack-into-someones-phone-camera.html)
- [How to Record a Phone Call on iPhone? (2026)](https://www.guru99.com/how-to-record-phone-call-iphone.html)

## DoS Attack Tools

The following are some of the tools that can be used to perform DoS attacks.

- Nemesy – this tool can be used to generate random packets. It works on Windows. This tool can be downloaded from http://packetstormsecurity.com/files/25599/nemesy13.zip.html . Due to the nature of the program, if you have an antivirus, it will most likely be detected as a virus.
- Land and LaTierra – this tool can be used for IP spoofing and opening TCP connections.
- Blast – this tool can be downloaded from http://www.opencomm.co.uk/products/blast/features.php
- Panther – this tool can be used to flood a victim’s network with UDP packets.
- Botnets – these are multitudes of compromised computers on the Internet that can be used to perform a distributed denial of service attack.

Also Check:- [Best FREE DDoS Attack Online Tool | Software | Websites](https://www.guru99.com/ddos-attack-tools.html)

## How to Prevent DoS Attack?

An organization can adopt the following policy to protect itself against Denial of Service attacks.

- Attacks such as SYN flooding take advantage of bugs in the operating system. Installing security patches can help reduce the chances of such attacks.
- Intrusion detection systems can also be used to identify and even stop illegal activities.
- [Firewalls](https://www.guru99.com/best-free-firewall.html) can be used to stop simple DoS attacks by blocking all traffic coming from an attacker by identifying his IP.
- [Routers](https://www.guru99.com/router-vs-switch-difference.html) can be configured via the Access Control List to limit access to the network and drop suspected illegal traffic.

## Hacking Activity: Ping of Death

We will assume you are using Windows for this exercise. We will also assume that you have at least two computers that are on the same network. DoS attacks are illegal on networks that you are not authorized to attack. This is why you will need to set up your own network for this exercise.

Open the command prompt on the target computer.

Enter the command ipconfig. You will get results similar to the ones shown below.

[![Command prompt showing ipconfig output with the target IP address]()](https://www.guru99.com/images/EthicalHacking/DOS_Attacks1.png)

For this example, we are using [Mobile](https://www.guru99.com/mobile-testing.html) Broadband connection details. Take note of the IP address. Note: for this example to be more effective, you must use a [LAN network](https://www.guru99.com/lan-vs-wan.html).

Switch to the computer that you want to use for the attack and open the command prompt.

We will ping our victim computer with infinite data packets of 65500.

Enter the following command:

```
ping 10.128.131.108 –t |65500
```

HERE,

- “ping” sends the data packets to the victim
- “10.128.131.108” is the IP address of the victim
- “-t” means the data packets should be sent until the program is stopped
- “-l” specifies the data load to be sent to the victim

You will get results similar to the ones shown below.

[![Ping command flooding the victim IP with 65500-byte data packets]()](https://www.guru99.com/images/EthicalHacking/DOS_Attacks2.png)

Flooding the target computer with data packets does not have much effect on the victim. In order for the attack to be more effective, you should attack the target computer with pings from more than one computer.

The above attack can be used to attack routers, [web servers](https://www.guru99.com/how-to-hack-web-server.html), etc.

If you want to see the effects of the attack on the target computer, you can [open the task manager](https://www.guru99.com/how-to-open-task-manager-in-windows.html) and view the network activities.

- Right click on the taskbar
- Select start task manager
- Click on the network tab
- You will get results similar to the following

[![Task Manager network tab showing increased activity during the attack]()](https://www.guru99.com/images/EthicalHacking/DOS_Attacks3.png)

If the attack is successful, you should be able to see increased network activities.

## Hacking Activity: Launch a DoS Attack

In this practical scenario, we are going to use Nemesy to generate data packets and flood the target computer, router, or server.

As stated above, Nemesy will be detected as an illegal program by your [anti-virus](https://www.guru99.com/free-spyware-malware-removal-tools.html). You will have to disable the anti-virus for this exercise.

- Download Nemesy from http://packetstormsecurity.com/files/25599/nemesy13.zip.html
- Unzip it and run the program Nemesy.exe
- You will get the following interface

[![Nemesy interface for entering the target IP address and packet count]()](https://www.guru99.com/images/EthicalHacking/DOS_Attacks4.png)

Enter the target [IP address](https://www.guru99.com/ip-address-classes.html). In this example, we have used the target IP we used in the above example.

HERE,

- 0 as the number of packets means infinity. You can set it to the desired number if you do not want to send infinity data packets.
- The size field specifies the data bytes to be sent and the delay specifies the time interval in milliseconds.

Click on the send button.

You should be able to see the following results.

[![Nemesy title bar showing the number of packets sent to the target]()](https://www.guru99.com/images/EthicalHacking/DOS_Attacks5.png)

The title bar will show you the number of packets sent.

Click on the halt button to stop the program from sending data packets.

You can monitor the task manager of the target computer to see the network activities.

## What is a Distributed Denial-of-Service (DDoS) Attack?

A DDoS attack is an escalated form of a DoS attack where the malicious traffic comes from multiple sources – making it harder to stop the attack simply by blocking a single source. In a DDoS attack, multiple compromised computers, collectively referred to as a botnet, are used to flood the target system with traffic, thereby causing a denial of service. These attacks are more difficult to mitigate due to their distributed nature, as the attacker controls multiple sources of the traffic.

## FAQs

🌐 What is the difference between a DoS and a DDoS attack?

A DoS attack floods a target from a single machine, so blocking one IP address can stop it. A DDoS attack uses a botnet of many compromised devices at once, making it far larger and harder to trace.

⚖️ Is performing a DoS or DDoS attack illegal?

Yes. In the United States the Computer Fraud and Abuse Act treats denial-of-service attacks as a federal crime, with penalties reaching ten years in prison. Testing is legal only on systems you own or are explicitly authorized to assess.

⏱️ How long does a DDoS attack usually last?

Most are brief. [Cloudflare](https://blog.cloudflare.com/ddos-threat-report-2025-q4/) reports a majority of hyper-volumetric attacks now last under a minute, and over 60 percent finish within ten minutes. A few persist for hours or, rarely, several days when defenders cannot filter them.

📈 What is the largest DDoS attack ever recorded?

In December 2025, Cloudflare automatically mitigated a record 31.4 Tbps attack that lasted about 35 seconds. Records climbed steeply through 2025, from 7.3 Tbps in May to 15.7 Tbps in October, driven largely by huge IoT botnets.

🤖 How does AI help detect and mitigate DDoS attacks?

Machine-learning models learn a network’s normal baseline, then flag anomalies in packet rate, protocol mix, and connection duration within seconds. Modern systems reach over 99 percent detection accuracy and can trigger rate-limiting or scrubbing automatically within seconds.

🧠 Can GitHub Copilot help engineers defend against DoS attacks?

Not against live floods directly, but AI assistants like [GitHub Copilot](https://github.com/features/copilot) help write firewall rules, rate-limiting logic, and traffic-analysis scripts faster. Treat every suggestion as a draft and have a security reviewer validate it before deployment.

🕵️ Can a DoS attack be traced back to its source?

Single-source DoS traffic is often traceable to one IP, though attackers spoof addresses to hide. Botnet-driven DDoS traffic is far harder to attribute, so investigators rely on ISP cooperation, traffic forensics, and botnet takedowns.

💸 How much can a DoS or DDoS attack cost a business?

Downtime is the real expense. Industry studies put the average cost of a DDoS incident in the thousands of dollars per minute once lost sales, staff time, and reputation are counted. Always-on mitigation is cheaper than recovery.

#### Summarize this post with:

ChatGPTPerplexityGrokGoogle AI

**Stay Updated on AI** **Get Weekly AI Skills, Trends, Actionable Advice.**

##### Sign up for the newsletter

Subscribe for Free

You have successfully subscribed.  
Please check your inbox.

![AI-Newsletter]() Chosen by over **350,000+** professionals

[Scroll to topScroll to top](#wrapper) Scroll to top

×

Toggle Menu Close

Search for:

Search

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.guru99.com/#organization","name":"Guru99","sameAs":["https://www.facebook.com/Guru99Official","https://twitter.com/guru99com"],"logo":{"@type":"ImageObject","@id":"https://www.guru99.com/#logo","url":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","contentUrl":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","caption":"Guru99","inLanguage":"en-US"}},{"@type":"WebSite","@id":"https://www.guru99.com/#website","url":"https://www.guru99.com","name":"Guru99","publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.guru99.com/images/what-is-a-denial-of-service-dos-attack.png","url":"https://www.guru99.com/images/what-is-a-denial-of-service-dos-attack.png","width":"700","height":"250","caption":"What is a Denial of Service (DoS) Attack?","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://www.guru99.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://www.guru99.com/ethical-hacking","name":"Ethical Hacking"}},{"@type":"ListItem","position":"3","item":{"@id":"https://www.guru99.com/ethical-hacking/cyber-security","name":"Cyber Security"}},{"@type":"ListItem","position":"4","item":{"@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html","name":"What is a Denial of Service (DoS) Attack? Definition & Prevention"}}]},{"@type":"WebPage","@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html#webpage","url":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html","name":"What is a Denial of Service (DoS) Attack? Definition & Prevention","dateModified":"2026-07-21T10:54:51+05:30","isPartOf":{"@id":"https://www.guru99.com/#website"},"primaryImageOfPage":{"@id":"https://www.guru99.com/images/what-is-a-denial-of-service-dos-attack.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html#breadcrumb"}},{"@type":"Person","@id":"https://www.guru99.com/author/oliver","name":"Oliver Jones","description":"I'm Oliver Jones, an ethical hacker sharing insights on cybersecurity. With years of experience, I provide guides to help you safeguard your digital world.","url":"https://www.guru99.com/author/oliver","image":{"@type":"ImageObject","@id":"https://www.guru99.com/images/oliver-jones-auhtor.png","url":"https://www.guru99.com/images/oliver-jones-auhtor.png","caption":"Oliver Jones","inLanguage":"en-US"},"worksFor":{"@id":"https://www.guru99.com/#organization"}},{"articleSection":"Cyber Security, Ethical Hacking","headline":"What is a Denial of Service (DoS) Attack? Definition & Prevention","description":"This DoS (Denial of Service) Tutorial covers topics like Types of Dos Attacks, How DoS attacks work, DoS Attack Tools, Dos Protection, and more.","keywords":"hacking","speakable":{"@type":"SpeakableSpecification","cssSelector":[".entry-title",".summary"]},"@type":"Article","author":{"@id":"https://www.guru99.com/author/oliver","name":"Oliver Jones"},"dateModified":"2026-07-21T10:54:51+05:30","image":{"@id":"https://www.guru99.com/images/what-is-a-denial-of-service-dos-attack.png"},"copyrightYear":"2026","name":"What is a Denial of Service (DoS) Attack? Definition & Prevention","subjectOf":[{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the difference between a DoS and a DDoS attack?","acceptedAnswer":{"@type":"Answer","text":"A DoS attack floods a target from a single machine, so blocking one IP address can stop it. A DDoS attack uses a botnet of many compromised devices at once, making it far larger and harder to trace."}},{"@type":"Question","name":"Is performing a DoS or DDoS attack illegal?","acceptedAnswer":{"@type":"Answer","text":"Yes. In the United States the Computer Fraud and Abuse Act treats denial-of-service attacks as a federal crime, with penalties reaching ten years in prison. Testing is legal only on systems you own or are explicitly authorized to assess."}},{"@type":"Question","name":"How long does a DDoS attack usually last?","acceptedAnswer":{"@type":"Answer","text":"Most are brief. Cloudflare reports a majority of hyper-volumetric attacks now last under a minute, and over 60 percent finish within ten minutes. A few persist for hours or, rarely, several days when defenders cannot filter them."}},{"@type":"Question","name":"What is the largest DDoS attack ever recorded?","acceptedAnswer":{"@type":"Answer","text":"In December 2025, Cloudflare automatically mitigated a record 31.4 Tbps attack that lasted about 35 seconds. Records climbed steeply through 2025, from 7.3 Tbps in May to 15.7 Tbps in October, driven largely by huge IoT botnets."}},{"@type":"Question","name":"How does AI help detect and mitigate DDoS attacks?","acceptedAnswer":{"@type":"Answer","text":"Machine-learning models learn a network's normal baseline, then flag anomalies in packet rate, protocol mix, and connection duration within seconds. Modern systems reach over 99 percent detection accuracy and can trigger rate-limiting or scrubbing automatically within seconds."}},{"@type":"Question","name":"Can GitHub Copilot help engineers defend against DoS attacks?","acceptedAnswer":{"@type":"Answer","text":"Not against live floods directly, but AI assistants like GitHub Copilot help write firewall rules, rate-limiting logic, and traffic-analysis scripts faster. Treat every suggestion as a draft and have a security reviewer validate it before deployment."}},{"@type":"Question","name":"Can a DoS attack be traced back to its source?","acceptedAnswer":{"@type":"Answer","text":"Single-source DoS traffic is often traceable to one IP, though attackers spoof addresses to hide. Botnet-driven DDoS traffic is far harder to attribute, so investigators rely on ISP cooperation, traffic forensics, and botnet takedowns."}},{"@type":"Question","name":"How much can a DoS or DDoS attack cost a business?","acceptedAnswer":{"@type":"Answer","text":"Downtime is the real expense. Industry studies put the average cost of a DDoS incident in the thousands of dollars per minute once lost sales, staff time, and reputation are counted. Always-on mitigation is cheaper than recovery."}}]}],"@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html#schema-1146668","isPartOf":{"@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html#webpage"},"publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://www.guru99.com/ultimate-guide-to-dos-attacks.html#webpage"}}]}
```