A 50-Line Script Can Saturate Your 10 Gbps Link — Here’s How to Survive a DDoS Attack

In January 2025, a teenager armed with a 47-line Python script saturated a French hosting provider’s 10 Gbps link for six hours. In March 2026, Cloudflare mitigated a 5.6 Tbps volumetric attack — the largest ever recorded — in under three seconds across its global network of 330 data centers. These two events are not contradictory: they illustrate the gap between a naked target and a protected one.

A Distributed Denial of Service (DDoS) attack does not exploit a software vulnerability. It exploits an asymmetry: the cost of generating traffic is near zero, the cost of absorbing it is immense. A botnet rented for $5 an hour can generate enough packets to drown an unprotected server. The good news is that defense has caught up with offense — provided you know which lever to pull.

The Two Families of DDoS Attacks: Understand Before You Defend

Not all DDoS attacks are the same. Classifying them by OSI layer is the first step toward choosing the right countermeasure. There are two broad families.

Infrastructure Attacks (L3/L4): Volumetric Bombardment

Layer 3 (network) and Layer 4 (transport) attacks aim to saturate bandwidth or exhaust the state tables of the TCP/IP stack. They are the most common — Cloudflare estimates they represent over 80% of observed DDoS attacks in 2025 — and the easiest to launch.

DNS amplification. An attacker sends a 60-byte DNS query to an open resolver while spoofing the victim’s source IP. The resolver responds with a 3,000 to 4,000-byte packet — an amplification factor of 50× to 70×. NTP, Memcached, and CLDAP follow the same principle, with amplification factors reaching up to 51,000× for Memcached (a single 15-byte request triggers a multi-megabyte response). The inbound traffic saturates the network link before the server ever processes a single valid packet.

SYN flood. The attacker sends a torrent of TCP SYN packets without ever completing the handshake (no ACK). Each inbound SYN consumes an entry in the kernel’s connection table. When the table fills up, the server refuses legitimate connections. A modern machine can generate 10 million SYNs per second with a tool like hping3 — more than enough to drown an unprotected server.

UDP flood. The attacker bombards a random port with UDP packets. The server responds with an ICMP “port unreachable” message for each packet received, doubling CPU and network load. No amplification is needed: a single €3/month VPS can generate 1 Gbps of continuous UDP traffic.

The common thread: these attacks never look at application-layer content. Volume is the only weapon. The defense therefore plays out before packets ever reach your server.

Application-Layer Attacks (L7): Surgical Exhaustion

Layer 7 (application) attacks target server resources — CPU, memory, database connections — with traffic that is perfectly compliant with the HTTP protocol. They represent less than 20% of attacks but are far harder to detect, because every request appears legitimate.

HTTP flood. The attacker sends GET or POST requests to an expensive page — /search?q=aaaaaaaa, /login, an API endpoint that triggers a heavy SQL join. Each request consumes 10× to 100× more server resources than a request for a static page. A thousand well-targeted requests per second can exhaust a backend that would serve 100,000 requests per second of static content without flinching.

Slowloris. The most minimalist tool in existence. It opens HTTP connections and sends headers… partially, one character at a time, never completing the request. The server keeps each connection open waiting for the rest. With Apache prefork, each hanging connection consumes a full process: a few hundred connections are enough to exhaust the worker pool. Network load is zero; the effect is total.

R.U.D.Y. (R-U-Dead-Yet). A Slowloris variant that targets POST forms: the attacker submits a form field one byte at a time, keeping the connection open indefinitely. Tools like the OWASP HTTP Post Tool automate the process.

HTTP/2 Rapid Reset (CVE-2023-44487). A newer vector that exploits HTTP/2’s stream multiplexing. The attacker opens a stream, sends a request, and immediately sends a RST_STREAM frame to cancel it — then repeats thousands of times per connection. In October 2023, this technique generated DDoS attacks peaking at 398 million requests per second against Google Cloud, the largest L7 attack measured at the time. AWS, Cloudflare, and Google all issued emergency patches.

These attacks cannot be blocked at the network layer — they require HTTP protocol inspection and an understanding of the application’s normal behavior.

Why a 50-Line Script Is All It Takes

The myth of the “hacker in a basement with supercomputers” died years ago. Today, launching a DDoS attack involves three steps accessible to any computer science undergraduate.

First, find an amplification vector. Services like Shodan continuously index millions of open DNS resolvers, exposed Memcached servers, and unfiltered CLDAP services. A query like port:11211 country:DE on Shodan returns hundreds of exploitable Memcached targets in seconds.

Second, write the script. Here is a working DNS amplification example in Python — the code fits in 30 lines:

import socket

TARGET = "203.0.113.10"  # Victim’s IP
RESOLVERS = ["8.8.8.8", "1.1.1.1", "9.9.9.9"]  # Open resolvers

# DNS ANY query for a domain with a large zone
query  = b"\xaa\xbb\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00"
query += b"\x07example\x03com\x00\x00\xff\x00\x01"

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
while True:
    for resolver in RESOLVERS:
        sock.sendto(query, (resolver, 53))

The principle is elementary: you spoof the source IP (using a VPS that does not filter spoofing, or a compromised network), send a 50-byte DNS ANY query, and the resolver replies with the full DNS zone — sometimes 4,000 bytes — directly to the victim. Repeat across 100 open resolvers in a while True loop, and you generate multiple gigabits per second from a single VPS.

Third, rent the firepower. If writing the script feels like too much work, stresser services (illegal but ubiquitous) offer turnkey attacks for $5 to $50. A December 2025 report by Cloudflare notes that 60% of observed DDoS attacks originate from stresser services marketed as “network testers.”

The result: your 10 Gbps link is saturated. Your server stops responding. Your users see a blank page. All for the price of lunch.

The DDoS Defense Pyramid: Four Layers, Zero Shortcuts

There is no single solution to DDoS. Defense is a four-tier pyramid, with each tier blocking attacks the lower tiers cannot see.

Tier 1: BGP Blackholing and Scrubbing Centers

BGP blackholing (RFC 3882, RTBH — Remotely Triggered Black Hole) is the most brutal and most effective method against volumetric attacks. Your ISP or transit provider announces a route for your IP prefix with a BGP community that redirects all traffic to a null interface — a trash can. Result: the attack disappears, but your service disappears too for inbound traffic. It’s the nuclear button: effective, blind, last resort only.

A scrubbing center is the intelligent evolution of blackholing. Instead of dumping all traffic, it redirects it to filtering centers that clean malicious packets and forward legitimate traffic to your infrastructure via a GRE tunnel. Time to Mitigate (TTM) ranges from a few seconds (Cloudflare claims under 3 seconds) to several minutes for traditional appliance-based solutions.

CISA, the US Cybersecurity and Infrastructure Security Agency, recommends scrubbing centers as a primary defense for critical infrastructure in its 2024 DDoS Mitigation Guidance (published jointly with the FBI and MS-ISAC). The guideline emphasizes that scrubbing must be always-on for high-value targets — on-demand redirection adds minutes of downtime before mitigation kicks in.

Tier 2: CDN and Reverse Proxy

A CDN like Cloudflare, Fastly, or Akamai absorbs L3/L4 attacks through sheer network surface area. With 500 Tbps of capacity, Cloudflare can absorb an attack 23× larger than the biggest DDoS ever recorded (approximately 2.3 Tbps in 2024). The traffic never reaches your origin server — the CDN acts as a buffer.

Fastly (operating on an Anycast network with over 80 points of presence) takes a different approach: its next-generation WAF (Powered by Signal Sciences, acquired in 2020) combines a rule engine with behavioral analysis that blocks L7 attacks based on statistical anomaly rather than signatures. The commercial argument is latency: Fastly claims sub-30 ms TTFB in Europe, compared to 40–50 ms for Cloudflare on the same traffic profile.

One critical caveat: a CDN alone does not protect your non-HTTP services (SSH, SMTP, databases, game servers). It covers the web and APIs, but the rest of your attack surface remains exposed.

Tier 3: WAF and Rate Limiting

The Web Application Firewall (WAF) operates at Layer 7. It inspects every HTTP request and blocks those matching known attack patterns — SQL injection, XSS, path traversal, but also DDoS patterns like request bursts targeting a single URL.

Rate limiting is its algorithmic counterpart. Instead of looking for signatures, it enforces thresholds: maximum 100 requests per second to /login from a single IP, maximum 50 concurrent TCP connections per source, maximum 10 MB/s of bandwidth per client. Implementations range from the ngx_http_limit_req_module module in NGINX (free, basic) to cloud solutions like Cloudflare Rate Limiting (up to 100 million requests per second on the Enterprise plan).

The rate limiting tradeoff is false positives. Blocking an entire IP prefix for exceeding a threshold can exclude legitimate users behind CGNAT (Carrier-Grade NAT), which is common on mobile networks. Modern solutions use JavaScript challenges (Cloudflare Challenge) or CAPTCHAs to distinguish humans from scripts without permanently blacklisting an IP address.

Tier 4: BGP-Based Always-On (Magic Transit, OVH Anti-DDoS)

This is the most advanced tier. Instead of waiting for an attack to be detected before redirecting traffic to a scrubbing center, traffic permanently passes through the provider’s network, which cleans packets inline before delivering them.

Cloudflare Magic Transit uses BGP announcements to attract inbound traffic to the Cloudflare data center closest to the attacker — not the victim. Malicious packets are identified and blocked by the 330 data centers of the global network before reaching the customer’s infrastructure. Clean traffic is forwarded via GRE tunnels or Private Network Interconnects (PNI). Cloudflare claims a mitigation time under 3 seconds and a capacity of 500 Tbps. Pricing: Enterprise-only, typically starting at several thousand dollars per month.

OVHcloud Anti-DDoS follows the same principle but with a different positioning. Protection is included by default on every OVHcloud product — from the €3/month VPS to Bare Metal servers. The infrastructure, developed in-house, totals 17 Tbit/s of filtering capacity and has proven itself against documented attacks up to 1.3 Tbit/s. The system combines always-on detection, automatic scrubbing center redirection, and a configurable Edge Network Firewall. The acknowledged downside: mitigation is sometimes slower than Cloudflare (TTM is not publicly documented), and L7 customization options are limited without subscribing to additional products.

Cloudflare, OVH, Fastly: Who Protects What

These three providers do not compete on the same playing field. The table below gives orders of magnitude, but the choice depends on your attack surface.

Verdict: Which Protection for Which Profile

Choosing a DDoS strategy comes down to two variables: attack surface and budget.

You run a marketing site or an early-stage SaaS. Enable a CDN with an integrated WAF — Cloudflare’s free plan (unlimited L3/L4 DDoS included) handles the vast majority of opportunistic attacks. Add basic rate limiting in your reverse proxy (NGINX limit_req_zone). Cost: zero dollars, thirty minutes of configuration. This covers 95% of DDoS attacks, which are low-volume and non-persistent.

You host game servers, real-time APIs, or non-HTTP services. CDN protection does not cover these protocols. Choose a hosting provider with native network protection: OVHcloud if your budget is tight (protection is included), Cloudflare Magic Transit if you need a guaranteed TTM and hundreds of Tbps of capacity. For online gaming, OVH has a track record — it is the historic host for Minecraft, Rust, and ARK: Survival Evolved, communities that endure daily DDoS attacks.

You operate a critical platform with high media or financial risk. Your attack surface requires all four tiers of the pyramid. Combine Magic Transit (always-on L3/L4) with a behavioral WAF (Fastly or Cloudflare), granular rate limiting, and prepare a BGP blackholing plan with your ISP as a last resort. Budget: expect $10,000 to $50,000 per month for full coverage.

A DDoS attack is no longer a technical inevitability. In 2026, with an Anycast network and a properly configured WAF, the only residual risk is financial — and that risk can be calculated, provisioned, and insured.

References

• Cloudflare Magic Transit — DDoS Protection for Networks
• OVHcloud Anti-DDoS Infrastructure
• AWS — What is a DDoS Attack?
• Cloudflare Learning Center — What is a DDoS Attack?
• RFC 3882 — Configuring BGP to Block Denial-of-Service Attacks (RTBH)
• CISA, FBI, MS-ISAC — Understanding and Responding to DDoS Attacks (2024)
• CVE-2023-44487 — HTTP/2 Rapid Reset Attack
• Fastly — Next-Gen WAF