DoS and DDoS are often used interchangeably, but the extra D changes almost everything about how the attack works and how you stop it. Both aim to make a service unavailable; the difference is how many machines are doing the attacking, and that single fact decides whether you can block it yourself or need protection in front of your server.
DoS: One Attacker, One Source
A denial-of-service (DoS) attack comes from a single machine. One computer sends a flood of requests or malformed packets to exhaust a server's CPU, memory or connection table. Because it originates from one address, a DoS is comparatively easy to stop: identify the source IP and block it at the firewall, and the attack is over.
DDoS: Thousands of Sources at Once
A distributed denial-of-service (DDoS) attack comes from many machines simultaneously — often a botnet of thousands or millions of compromised devices spread across the world. This distribution is what makes DDoS so hard to defend: there is no single IP to block, the traffic can exceed your total bandwidth, and every packet may come from a different, innocent-looking address.
The defining difference
A DoS is one attacker you can usually block by hand. A DDoS is thousands you cannot — which is why real DDoS defence has to happen in front of your server, at a proxy or network that can absorb or filter traffic from a huge number of sources at once.
Why DDoS Is So Much Harder to Stop
- No single source: blocking one IP does nothing when the flood comes from thousands.
- Scale: a distributed attack can generate far more traffic than a single machine, sometimes exceeding your uplink entirely.
- Camouflage: application-layer (Layer 7) DDoS sends valid-looking requests that are hard to tell apart from real users.
- Cheapness: attackers rent botnet capacity from stresser services for a few dollars, so the barrier is trivial.
How Each Is Defended
A simple DoS is handled at the server: firewall rules, fail2ban and rate limits are usually enough. A DDoS needs defence upstream of your origin. Network-layer (L3/L4) volumetric floods are absorbed by your host or transit provider's network; application-layer (L7) attacks are filtered at a reverse proxy that inspects each request, challenges automated clients, and rate-limits abusers. Akarguard is that L7 reverse proxy: you route your domain through it with a DNS change, and it filters application-layer attacks while hiding your origin so direct floods have no target.