Denial-of-Service (DoS) is a category of network attack — or any operational condition — that prevents a service from responding to legitimate requests, typically by exhausting the server's connection pool, CPU, memory, or bandwidth.
The classic attack pattern floods a target with traffic from a single source until the host can no longer serve real users. A distributed denial-of-service (DDoS) is the same outcome produced by many sources — typically a botnet of compromised devices coordinating to flood the target from thousands of IPs simultaneously, making source-blocking ineffective. DDoS attacks measured in terabits per second are now routine, and the largest documented events have exceeded 5 Tbps. The economic asymmetry is the attacker's leverage: a few hundred dollars of attack capacity can saturate a service that costs millions to operate.
Mitigation operates at the network edge rather than the origin. Services like 📝Cloudflare, Akamai, and AWS Shield absorb attack traffic by spreading it across a global anycast network, fingerprinting bot patterns, and challenging suspicious clients with proof-of-work or CAPTCHA puzzles before forwarding. The defense surface is large enough that no individual server is overwhelmed, and source-blocking happens at IP-prefix granularity using upstream telemetry.
Not every denial-of-service is malicious. The 📝Reddit Hug of Death — the server-crashing surge that follows a link hitting 📝Reddit's front page — is the canonical example of an unintentional DoS: the same traffic dynamics produced by legitimate readers rather than attackers. Slashdot's precursor inherited the same pattern. From the destination server's perspective, the failure mode is identical; only the intent differs.
The Hug of Death is the only DoS I've experienced from inside the destination — Reddit hugging the 📝Facebook Ads Prank into a brief existential crisis. It made the distinction between attack and affection feel academic. The server doesn't care which one is happening.