# DDoS vs DoS: What's the Difference, and Why It Matters > A DoS attack comes from one source; a DDoS from thousands at once. Here's what actually separates them, why DDoS is far harder to stop, and how each is defended. - Category: Explainer - Author: Akarguard Team, Security Engineering - Published: Sep 13, 2026 - Canonical: https://akarguard.net/blog/ddos-vs-dos --- DoS and DDoS are often used interchangeably, but the extra D changes almost everything about how the attack works and how you stop it. Both aim to make a service unavailable; the difference is how many machines are doing the attacking, and that single fact decides whether you can block it yourself or need protection in front of your server. ## DoS: One Attacker, One Source A denial-of-service (DoS) attack comes from a single machine. One computer sends a flood of requests or malformed packets to exhaust a server's CPU, memory or connection table. Because it originates from one address, a DoS is comparatively easy to stop: identify the source IP and block it at the firewall, and the attack is over. ## DDoS: Thousands of Sources at Once A distributed denial-of-service (DDoS) attack comes from many machines simultaneously — often a botnet of thousands or millions of compromised devices spread across the world. This distribution is what makes DDoS so hard to defend: there is no single IP to block, the traffic can exceed your total bandwidth, and every packet may come from a different, innocent-looking address. > **The defining difference** — A DoS is one attacker you can usually block by hand. A DDoS is thousands you cannot — which is why real DDoS defence has to happen in front of your server, at a proxy or network that can absorb or filter traffic from a huge number of sources at once. ## Why DDoS Is So Much Harder to Stop - No single source: blocking one IP does nothing when the flood comes from thousands. - Scale: a distributed attack can generate far more traffic than a single machine, sometimes exceeding your uplink entirely. - Camouflage: application-layer (Layer 7) DDoS sends valid-looking requests that are hard to tell apart from real users. - Cheapness: attackers rent botnet capacity from stresser services for a few dollars, so the barrier is trivial. ## How Each Is Defended A simple DoS is handled at the server: firewall rules, fail2ban and rate limits are usually enough. A DDoS needs defence upstream of your origin. Network-layer (L3/L4) volumetric floods are absorbed by your host or transit provider's network; application-layer (L7) attacks are filtered at a reverse proxy that inspects each request, challenges automated clients, and rate-limits abusers. Akarguard is that L7 reverse proxy: you route your domain through it with a DNS change, and it filters application-layer attacks while hiding your origin so direct floods have no target. --- Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.