Q2 2020 Network-Layer DDoS Trends: Attacks Double as Bigger Threats Emerge
The shift to remote work and online services that began in the first quarter of 2020 continued to reshape the threat landscape in the second quarter. From April 1 through June 30, Cloudflare's network observed a marked acceleration in DDoS activity, with the total number of L3/4 attacks doubling compared to Q1. This period also saw some of the largest attacks ever recorded on our network, alongside a broader range of attack vectors and wider geographic distribution of attack sources.
Attack Volume and Seasonal Peaks
Cloudflare's automated DDoS protection system, Gatebot, handled a record volume of globally distributed attacks—those observed across multiple edge data centers simultaneously. The number of such attacks detected and mitigated in Q2 doubled quarter over quarter. This acceleration was not uniform across the quarter: May was the busiest month in the first half of 2020, accounting for nearly a third of all L3/4 attacks observed. Over 66% of all global DDoS attacks in 2020 occurred in Q2, with 63% of attacks peaking above 100 Gbps occurring in May alone.
The rising frequency of attacks during this period likely correlates with the heightened dependence on internet infrastructure as shelter-in-place mandates remained in effect globally. Attackers showed particular eagerness to disrupt online services during May, when the pandemic's impact continued to intensify worldwide.
Size and Duration Distribution
While the headlines focus on massive volumetric attacks, the majority of L3/4 DDoS attacks observed in Q2 were relatively small by network-wide standards. Nearly 90% of all attacks peaked below 10 Gbps—a volume that can still easily take down most unprotected websites. From a packet rate perspective, 76% of attacks peaked at or below 1 million packets per second, which is within the range a standard 1 Gbps Ethernet interface can handle under load, making even these "small" attacks dangerous for organizations without adequate mitigation.
Attack duration remained consistent with Q1 trends. In Q2, 83% of attacks lasted between 30 and 60 minutes, compared to 79% in the previous quarter. While these may seem like brief windows, a 30-to-60 minute attack represents a sustained cyber battle that can force organizations to reboot appliances, restore services, and deal with the cascading costs of downtime.
Record-Breaking Attacks
Q2 2020 marked a significant milestone for attack scale. A substantial portion of the largest attacks ever seen on Cloudflare's network occurred during this period—88% of all 2020 attacks exceeding 100 Gbps took place after mid-March, when pandemic-related restrictions took effect.
In terms of packet rate, June was particularly notable. An attack peaking at 754 million packets per second was automatically detected and mitigated, marking one of the largest packet-based attacks ever recorded. This was part of a coordinated four-day campaign from June 18–21, during which traffic from over 316,000 distinct IP addresses targeted a single Cloudflare IP address. Outside of this extreme case, maximum packet rates hovered around 200 million pps throughout the quarter.
The 754 million pps attack was handled without any performance impact thanks to Cloudflare's globally distributed network architecture. The ability to absorb attack traffic and mitigate it close to the source while continuing to serve legitimate user traffic without added latency proved essential to weathering such large-scale events.
Geographic Targeting
Analysis of L3/4 DDoS attack distribution by our edge data centers shows the United States received the most attacks at 22.6%, followed by Germany (4.4%), Canada (2.7%), and Great Britain (2.6%).
However, when measuring by total attack bytes mitigated rather than attack count, the ranking shifts. The United States still leads with 34.9%, but Hong Kong jumps to second place at 6.6%, followed by Russia (6.5%), Germany (4.5%), and Colombia (3.7%). While Hong Kong accounted for only 1.8% of observed attacks, the attacks directed at it were extremely volumetric, generating enough traffic to push it to the top of the list by bandwidth.
This data is bucketed according to the Cloudflare data center where traffic was observed, not the source IP address. This is a deliberate methodology choice, as attackers frequently spoof source IPs to obfuscate their origins. By measuring at the edge where traffic enters our network, we gain a more accurate picture of attack geography.
Attack Vectors
Q2 saw attackers diversify their methods. We observed 39 distinct L3/4 attack vectors during the quarter, up from 34 in Q1. SYN floods continued to dominate, accounting for over 57% of attacks. RST floods followed at 13%, with UDP floods at 7%, CLDAP at 6%, and SSDP at 3%.
SYN flood attacks exploit the TCP handshake process by sending a flood of connection request packets with the synchronize (SYN) flag set. This overwhelms the router's connection table, which then allocates memory for each half-open connection while waiting for a final acknowledgment (ACK) that never arrives. Once the router's memory is exhausted by these bogus connections, legitimate clients can no longer establish sessions, resulting in a denial of service.
These varied threats are mitigated automatically by Cloudflare's three-pronged DDoS defense system:
- Gatebot — Cloudflare's centralized DDoS protection system for globally distributed volumetric attacks. It collects traffic samples from every edge data center, analyzes them, and sends automated mitigation instructions to the edge when attacks are detected.
- dosd (denial of service daemon) — A decentralized protection system that runs autonomously on every server in every data center, enabling high-speed local detection and mitigation that improves overall network resilience.
- flowtrackd (flow tracking daemon) — Cloudflare's TCP state tracking engine that detects and mitigates randomized and sophisticated TCP-based attacks by identifying legitimate connection states and dropping or rate-limiting packets that do not comply.
In addition to these automated systems, Cloudflare's real-time threat intelligence feeds into customer-facing firewall and rate-limiting tools, allowing for customized protection policies.
