When 1 Tbps Isn’t Enough: Understanding Modern DDoS Attacks
Imagine opening a website and seeing nothing but “This site can’t be reached.”
The servers might still be running. The application might still be working. But legitimate users simply cannot reach it.
This is the basic idea behind a Distributed Denial-of-Service (DDoS) attack.
And the scale of these attacks is getting harder to ignore.
According to Cloudflare’s H1 2026 DDoS report, it mitigated 935 network-layer DDoS attacks exceeding 1 Tbps during the first half of 2026. The number of such attacks increased by 519% from Q1 to Q2.
So what does a 1 Tbps attack actually mean, and how can a network defend against it?
What is a DDoS Attack?
A Denial-of-Service (DoS) attack attempts to make a service unavailable by exhausting its resources.
A DDoS attack does the same thing, but from many sources.
Attacker
|
Command & Control
|
┌──────────┼──────────┐
↓ ↓ ↓
Botnet Botnet Botnet
\ | /
\ | /
└─────── ↓ ───────┘
TargetInstead of one machine sending traffic, thousands or even millions of devices can participate.
These devices may include compromised computers, servers, routers, or IoT devices.
The objective is simple:
Send more traffic or requests than the target can handle.
AWS classifies DDoS attacks broadly across network/transport layers and application-layer attacks, including UDP reflection, SYN floods, HTTP floods, and DNS query floods.
What Does 1 Tbps Actually Mean?
1 Tbps = 1,000 Gbps
That’s an enormous amount of network traffic.
But bandwidth is only one part of the problem.
DDoS attacks can also be measured using:
- bps — bits per second
- pps — packets per second
- rps — requests per second
Each metric can target a different bottleneck.
For example:
High Gbps
↓
Bandwidth exhaustionHigh PPS
↓
Router / Firewall exhaustionHigh RPS
↓
Application / Server exhaustion
This is why a smaller attack can sometimes cause more damage than a larger one if it targets the right weakness.
Google describes these three measurements — bps, pps, and rps — as useful ways to understand different DDoS pressures on network links, network equipment, and applications.
The Interesting Part: Reflection and Amplification
Modern DDoS attacks aren’t always about having an enormous botnet directly attack the victim.
Attackers can abuse legitimate internet services to reflect and amplify traffic.
The basic idea is:
Attacker
|
| Small request
↓
Open / vulnerable service
|
| Large response
↓
VictimThe attacker spoofs the victim’s IP address in the request.
The third-party server then believes the victim made the request and sends its response to the victim.
Now imagine thousands of such servers doing the same thing.
That’s a reflection attack.
If the response is significantly larger than the original request, it becomes an amplification attack.
CISA explains that some UDP-based protocols can generate responses many times larger than the original request, making reflection and amplification possible.
DNS: A Major Part of the Problem
DNS is one of the most important services on the Internet, which also makes it an attractive DDoS target.
Cloudflare reported that DNS-based attacks accounted for 34.3% of network-layer DDoS activity in H1 2026. DNS floods alone increased from 25.7% of network-layer attacks in Q1 to 40% in Q2.
There are two different concepts worth understanding:
DNS Flood
Attackers send huge numbers of DNS queries directly toward DNS infrastructure.
Millions of DNS Queries
↓
DNS Server
↓
Resource ExhaustionDNS Amplification
The attacker sends small spoofed DNS queries to open resolvers.
The resolver sends much larger responses toward the victim.
Attacker
↓
Small spoofed DNS query
↓
Open DNS Resolver
↓
Large DNS response
↓
VictimThe important difference is that the attacker is using another system to generate traffic toward the victim.
It’s Not Only DNS
DNS isn’t the only protocol abused for amplification.
Other UDP-based services can also become reflection sources when exposed or incorrectly configured.
One example gaining attention in 2026 is CLDAP (Connectionless Lightweight Directory Access Protocol).
Cloudflare reported a 580% quarter-over-quarter increase in CLDAP flood activity in Q2 2026, making it the third-largest network-layer attack vector in that quarter.
The common factor is important:
UDP + spoofed source address + publicly reachable service = potential reflection abuse
Get SHASHANK M B’s stories in your inbox
Join Medium for free to get updates from this writer.
This is why exposed network services need to be carefully configured and monitored.
So How Do We Defend Against a 1 Tbps Attack?
The biggest mistake would be thinking:
“Let’s just buy a bigger firewall.”
At very large volumes, the traffic may already overwhelm the network connection before it reaches the firewall.
DDoS defense therefore needs to happen at multiple layers.
1. Upstream Protection
Traffic can be filtered before it reaches the organization’s network.
This can involve:
- ISP-level filtering
- DDoS scrubbing providers
- Anycast networks
- Cloud-based DDoS protection
The idea is simple:
Internet
↓
DDoS Protection / Scrubbing
↓
Clean Traffic
↓
Organization2. Rate Limiting
Not every client needs unlimited traffic.
Rate limiting can restrict:
- Requests per second
- Packets per second
- Connections per IP
- DNS queries
- API requests
This can prevent a single source or pattern from consuming all available resources.
3. Network Filtering
Firewalls, ACLs, routers, and upstream providers can filter traffic based on:
- Source IP
- Destination IP
- Protocol
- Port
- Packet characteristics
CISA also recommends measures such as stateful UDP inspection, upstream coordination, rate limiting, and ingress filtering to reduce reflection/amplification attacks and spoofed traffic.
4. Anycast and Distributed Infrastructure
Instead of sending all traffic to one location, services can be distributed across multiple network locations.
Internet
|
┌─────────┼─────────┐
↓ ↓ ↓
Region A Region B Region C
| | |
Server Server ServerAn attack is therefore distributed across the provider’s infrastructure instead of being concentrated on a single network edge.
The Indian Banking Example
This isn’t just a theoretical problem.
In May 2026, Akamai reported defending an Indian public-sector bank against multi-vector DDoS attacks. One attack reached 1.72 Tbps and nearly 23 million packets per second.
This is a good example of why looking only at bandwidth isn’t enough.
The attack targeted both network bandwidth and perimeter infrastructure, showing that attackers can combine different traffic characteristics to create pressure at multiple points.
The Bigger Picture
The interesting thing about modern DDoS attacks isn’t simply that the numbers are getting bigger.
It’s that attackers are becoming better at finding different bottlenecks.
DDoS Attack
|
┌───────────┼───────────┐
↓ ↓ ↓
Network Transport Application
↓ ↓ ↓
Gbps PPS RPS
↓ ↓ ↓
Bandwidth Devices ServersA network can have huge bandwidth and still experience problems if its routers, firewalls, applications, or upstream links become overloaded.
That’s why modern DDoS protection is about more than simply having a large internet connection.
Final Takeaway
A 1 Tbps DDoS attack sounds almost impossible to handle, but the real question isn’t:
“How big is the attack?”
It’s:
“What part of the infrastructure is the attack trying to exhaust?”
Bandwidth, packets, connections, DNS infrastructure, firewalls, and applications can all become bottlenecks.
Modern DDoS defense therefore requires a combination of:
Visibility + Filtering + Rate Limiting + Distributed Infrastructure + Upstream Protection
The goal isn’t to make an organization impossible to attack.
The goal is to make sure that malicious traffic doesn’t become the reason legitimate users can’t access the service.
References
- Cloudflare — DDoS Threat Report H1 2026
- AWS — Best Practices for DDoS Resiliency
- CISA — UDP-Based Amplification Attacks
- Google Cloud — Defending Against Large-Scale DDoS Attacks
- Akamai — Defending an Indian Bank Against Record-Breaking DDoS Attacks
Disclaimer: This article is for educational purposes. Technical information is based on publicly available security reports and documentation, with sources credited where referenced. All visuals are AI-generated for educational illustration and are not reproduced from external sources.
