Classical volumetric detection watches individual destinations: when traffic to one address crosses a threshold, mitigation engages. Carpet bombing is the answer to that design. The attacker spreads traffic across hundreds or thousands of addresses in a network range, keeping every individual destination below the alarm while the sum saturates shared infrastructure.
Why It Works
- Per-destination thresholds never trip, because no destination is individually flooded.
- The damage happens on shared links, routers, and firewalls that all those addresses depend on.
- It is hard to attribute: each target sees a modest, plausible amount of unexplained traffic.
- Automatic mitigation that works per address may engage on dozens of small targets at once, which is expensive and slow.
Who feels it first
Hosting providers, ISPs, and anyone announcing their own address space. A single website behind a proxy is rarely the direct victim, but is very often collateral damage when its provider is the target.
Detecting It
The signal is only visible in aggregate. Flow telemetry summed across the whole prefix shows the rise clearly, even when every per-host graph looks unremarkable. The practical requirement is monitoring that can ask about a network range rather than a single server, and alerting on the ratio of unusual traffic to baseline rather than absolute volume.
Responding
- Alert on prefix-level aggregates, not only per-host counters.
- Where protection is delivered by routing, ensure announcements cover the whole prefix rather than individual addresses.
- Filter the underlying vectors — the transport is usually familiar reflection and amplification, just distributed differently.
- If you are a customer rather than the network operator, ask your provider what their prefix-level detection looks like. During a carpet bombing event, their answer determines your uptime more than your own configuration does.
The Broader Lesson
Carpet bombing is not a new transport; it is a new addressing strategy aimed at the shape of detection systems. It is a useful reminder that thresholds are assumptions, and that attackers read the same product documentation you do.