What Is a DDoS Attack? 2026 Guide to Choosing a DDoS-Protected Server
DDoS (Distributed Denial of Service) attacks are one of the most common threats facing websites, game servers, APIs and other online services. Attackers control large numbers of devices that simultaneously send traffic or requests to a target, exhausting its bandwidth, connection capacity or compute resources so that legitimate users can no longer get through. Understanding attack types and how protection works is essential for making the right decisions when buying servers and deploying services.
Key Takeaways
- A DDoS (Distributed Denial of Service) attack uses large numbers of devices to send traffic or requests simultaneously, exhausting a server's bandwidth, connection capacity or compute resources so legitimate users can't get through.
- A null route (blackhole) is a damage-control measure in which the data center drops all traffic to an attacked IP once the attack exceeds its protection threshold; it does not help a service withstand the attack.
- CC attacks target the application layer, so a DDoS-protected server alone is not enough and must be combined with CDN/WAF, rate limiting, CAPTCHAs and caching.
- Effective DDoS protection combines network-layer scrubbing, application-layer filtering and hiding the origin IP; no single measure solves it once and for all.
- IMIDC offers DDoS-protected cloud servers and dedicated servers in Hong Kong, Japan, the United States and other regions, deployable with multiple IPs and CN2 routes and backed by 24/7 technical support.
Who This Is For / Prerequisites
- Site owners and ops engineers running websites, game servers, APIs, live streaming or e-commerce platforms.
- A Linux server (example commands work on Ubuntu, Debian, Rocky/AlmaLinux) with root access.
- We recommend completing basic security hardening first; see the Linux SSH Security Hardening Guide.
Guide / Steps
1. Common Types of DDoS Attacks
SYN Flood (network/transport layer): The attacker sends a flood of TCP SYN packets with spoofed source addresses. The server allocates resources for each half-open connection and waits for an acknowledgment, until the connection queue fills up and new legitimate connections can no longer be established.
UDP Flood: Massive volumes of UDP packets are sent to random or specific ports on the target, mainly to saturate bandwidth. Because UDP requires no handshake, the attack is extremely cheap to launch and is often measured in Gbps or even Tbps.
Reflection/amplification attacks: The attacker spoofs the victim's IP and sends small requests to publicly exposed DNS, NTP, Memcached, SSDP, CLDAP and similar services, which then send much larger responses to the victim. Amplification factors range from tens to tens of thousands of times, making this the main source of high-volume attacks.
CC attacks (application layer / HTTP Flood): The attacker mimics real users by repeatedly requesting resource-intensive endpoints such as pages, search and login. Traffic volume isn't necessarily large, but it can overwhelm the CPU, database and PHP processes, and it is hard to distinguish from normal traffic.
2. Typical Symptoms of an Attack
- The website or service suddenly becomes widely unreachable; ping latency spikes or all pings time out.
- Server bandwidth is maxed out, but real business traffic has not grown accordingly.
- CPU usage and load spike abnormally, and web logs show large numbers of requests to the same URL or with unusual User-Agents.
- The data center notifies you that the IP has been diverted (null-routed), and the server is completely unreachable.
You can get a quick picture with the following commands:
# Summary of connection states
ss -s
# Count connections per TCP state; many SYN-RECV entries may indicate a SYN Flood
ss -ant | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rn
# Top 20 source IPs by connection count
ss -ntu | awk 'NR>1 {split($6,a,":"); print a[1]}' | sort | uniq -c | sort -rn | head -20
# Watch live traffic (requires iftop or nload)
iftop -nNP -i eth0
# Capture a small sample of packets to analyze protocols and sources
tcpdump -nn -i eth0 -c 200
Note: IPv6 addresses contain colons, so the colon-split count above only works for IPv4 and is meant as a quick reference.
3. What Is a Null Route (Blackhole)?
When attack traffic exceeds the protection threshold that a data center or network link can absorb, the carrier or data center drops all traffic to the attacked IP to protect other customers on the same network. This is called a "blackhole" or "null route." While null-routed, the IP is completely unreachable. The block is usually lifted automatically after a period of time, but may be extended if the attack continues. A null route is a damage-control measure; it does not help you "withstand" the attack. Services that require high stability therefore need network links and servers with adequate protection capacity.
4. How to Choose a DDoS-Protected Server
Focus on the following when evaluating options:
- Protection bandwidth and scrubbing capacity: Is there a clearly stated peak protection capacity, and what happens when it is exceeded (null-route duration, upgrade options)?
- Protection coverage: Does it cover network-layer attacks such as SYN, UDP and reflection/amplification, and are there policies for application-layer attacks?
- Network routes and location: For users in mainland China, consider nodes in Hong Kong, Japan or Singapore with CN2 return routes, balancing protection with latency. See How to Choose a Server Location.
- IP resources: Can you change IPs after an attack, and are multiple IPs supported so you can switch services over?
- Technical response: Is 24/7 support available, and can you communicate quickly to adjust settings during an attack?
For exact protection specifications, refer to the product pages on the IMIDC website and replies to your support tickets.
5. Application-Layer Protection: CDN, Rate Limiting and Hiding Your Origin
DDoS-protected servers mainly address volumetric attacks; CC attacks rely more on application-layer defenses.
Use a CDN or WAF: Have users connect to CDN edge nodes, which absorb and filter malicious requests, and let the origin accept only traffic from the CDN.
Nginx rate limiting: Define the rules in the http block and reference them in server or location:
http {
limit_req_zone $binary_remote_addr zone=req_per_ip:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=conn_per_ip:10m;
server {
location / {
limit_req zone=req_per_ip burst=20 nodelay;
limit_conn conn_per_ip 30;
}
}
}
After editing, test the configuration and reload:
nginx -t && systemctl reload nginx
Enable SYN cookies (enabled by default on most distributions; you can verify):
sysctl net.ipv4.tcp_syncookies
sysctl -w net.ipv4.tcp_syncookies=1
Hide your origin IP: Once an attacker learns your real IP, they can bypass the CDN and attack it directly. Best practices: allow only the CDN's origin-pull IPs to access ports 80/443 on the origin; don't expose the origin IP through mail services, subdomain DNS records or historical DNS records; and if the origin IP has already leaked, switch to a new IP after putting the CDN in front. Taking Cloudflare as an example, its origin-pull IP ranges are published at https://www.cloudflare.com/ips-v4, which you can use to build a firewall allowlist.
FAQ
Can a regular server with a firewall stop DDoS attacks?
Only small attacks. Volumetric attacks saturate upstream bandwidth before traffic ever reaches your server, so you need scrubbing capacity at the data center or network level.
Is a DDoS-protected server enough against CC attacks?
No. CC attacks target the application layer and require a combination of CDN/WAF, rate limiting, CAPTCHAs and caching strategies.
What should I do if my IP is null-routed?
Wait for it to be lifted automatically, or submit a ticket to ask about the null-route duration and whether you can change IPs. Meanwhile, investigate the attack source and evaluate whether you need to upgrade your protection plan.
Do I still need DDoS protection after hiding my origin?
If the CDN's protection capacity is sufficient and the origin IP hasn't leaked, the risk is lower. However, CDNs often can't cover games and other non-HTTP TCP/UDP services, which still require DDoS-protected network links.
Summary
DDoS protection is a combined effort of "network-layer scrubbing + application-layer filtering + origin hiding"; no single measure solves it once and for all. IMIDC offers DDoS-protected cloud servers and dedicated servers in Hong Kong, Japan, the United States and other regions, which can be deployed with multiple IPs and CN2 routes. If you're under attack or need help evaluating a protection plan, submit a ticket and our technical team will assist with analysis and adjustments 24/7.