# Carpet Bombing: The Attack That Stays Under Every Threshold

> Instead of flooding one address, the traffic is spread thinly across an entire network range. No single target looks attacked, the aggregate saturates the uplink, and most detection never fires.

- Category: Attack Analysis
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/carpet-bombing-ddos

---

Classical volumetric detection watches individual destinations: when traffic to one address crosses a threshold, mitigation engages. Carpet bombing is the answer to that design. The attacker spreads traffic across hundreds or thousands of addresses in a network range, keeping every individual destination below the alarm while the sum saturates shared infrastructure.

## Why It Works

- Per-destination thresholds never trip, because no destination is individually flooded.
- The damage happens on shared links, routers, and firewalls that all those addresses depend on.
- It is hard to attribute: each target sees a modest, plausible amount of unexplained traffic.
- Automatic mitigation that works per address may engage on dozens of small targets at once, which is expensive and slow.

> **Who feels it first** — Hosting providers, ISPs, and anyone announcing their own address space. A single website behind a proxy is rarely the direct victim, but is very often collateral damage when its provider is the target.

## Detecting It

The signal is only visible in aggregate. Flow telemetry summed across the whole prefix shows the rise clearly, even when every per-host graph looks unremarkable. The practical requirement is monitoring that can ask about a network range rather than a single server, and alerting on the ratio of unusual traffic to baseline rather than absolute volume.

## Responding

- Alert on prefix-level aggregates, not only per-host counters.
- Where protection is delivered by routing, ensure announcements cover the whole prefix rather than individual addresses.
- Filter the underlying vectors — the transport is usually familiar reflection and amplification, just distributed differently.
- If you are a customer rather than the network operator, ask your provider what their prefix-level detection looks like. During a carpet bombing event, their answer determines your uptime more than your own configuration does.

## The Broader Lesson

Carpet bombing is not a new transport; it is a new addressing strategy aimed at the shape of detection systems. It is a useful reminder that thresholds are assumptions, and that attackers read the same product documentation you do.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.