← ELI5 中文
ELI5

What is
a DDoS attack?

For anyone who has stared at a page that just won't load
No. 183Inside Computers & the InternetPart 29 of 29Fact-checked Oct 10, 2026
Video2:32 · English voice (AI) · English subtitles

Can't play sound? The illustrated version is right below.

Read the transcript

The full narration of the video.

You open a website. It just spins and spins, and never loads. Is it broken? Let's picture the website as a little noodle shop, and rule out the guesses one by one. Guess one: the shop is broken. But the kitchen lights are on, and noodles are ready to go. Not that.

Guess two: too many customers, like a ticket rush. But this time, not one person in line orders anything. They walk up, ask "what noodles do you have?", then get right back in line. Again, and again. The waiter is busy answering them. People who actually want noodles can't get in. A website gets jammed the same way. Every time you open a page, you're asking the counter a question. Too many questions, and it can't answer them all.

So why not just throw the troublemakers out? If it's one person, easy: spot them, ban them. The trouble is, there are millions of these fake customers. They come from everywhere, and look exactly like real ones. But who could summon millions of helpers at once? Hold that thought. This mischief is called distributed denial of service, or DDoS. Distributed means they come from all over. Denial of service means real customers get shut out.

It happens every day. One company that blocks these attacks for websites stopped over forty-seven million of them in 2025. That's more than one a second. In the first half of this year, the most targeted country was China. The biggest one lasted just thirty-five seconds. The data pouring in, every single second, was about a thousand HD movies. So how does a site hold up? Build a huge plaza in front of the door. Everyone enters the plaza first; real customers go in, the ones going in circles get walked out. It works well, but it's not magic. A big enough wave can fill the plaza too.

Now back to that question: where do millions of helpers come from? The answer: many aren't people at all. They're TV boxes, cameras and routers in ordinary homes, secretly loaded with a remote-control program. The record attack is thought to have used one to four million devices, mostly Android TV boxes. Some came with the program already inside. Their owners kept watching TV and never knew. So here's one small thing to try tonight: check whether your home camera and router still use their factory passwords. If they do, change them. And skip no-name boxes that promise every movie for free.

When you're done, come back and tell us: how many connected devices does your home have?

1

The page that keeps spinning

?

Is it broken?
Or just too busy?

Picture the website as a little noodle shop. Every time you open a page, you walk up to the counter and ask, "What noodles do you have?" Let's rule out the guesses one by one.

How a page normally reaches your phone: How a webpage is made

2

Nobody in line
orders anything

?????

The shop isn't broken: the kitchen lights are on and noodles are ready. It's not a ticket-rush crowd of too many real customers either.

These people ask "What noodles do you have?" and get right back in line, again and again. The waiter is busy answering them, and people who actually want noodles can't get in.

3

Can't kick them out:
millions, all alike

One troublemaker is easy: spot them, ban them. But these fake customers number in the millions, come from everywhere, and look exactly like real ones. You can't tell whom to throw out.

That's called
"distributed denial of service": DDoS.

Distributedthey come
from everywhere
Denial of servicereal customers
get shut out
4

It happens every day

47M+attacks one company
blocked in 2025
1+ a secon average
35 sechow long the record
attack lasted
≈1,000HD movies' worth
of data per second

That company blocks these attacks for websites. By its count, the most targeted country in the first half of this year was China.

5

Build a big plaza
out front

Everyone enters the plaza first. Real customers go into the shop; the ones going in circles get walked out. That's what attack-blocking companies do.

It works well, but it's not magic: a big enough wave can fill the plaza too.

6

Millions of helpers:
your boxes at home

Many "fake customers" aren't people at all. They're TV boxes, cameras and routers in ordinary homes, secretly loaded with a remote-control program.

The record attack is thought to have used 1 to 4 million devices, mostly Android TV boxes. Some came with the program already inside. Their owners kept watching TV and never knew.

A famous attack in 2016 ran on cameras and video recorders still using their factory passwords, and many big websites went down with it.

It jammed the service that looks up websites' "street addresses": What is DNS

7

One small thing tonight

Change factory passwordsIf your camera or router still uses one, set your own
Skip no-name boxesBe most wary of ones promising "every movie free"
It might be
your own box.
When you're done, tell us:
how many connected devices does your home have?
UP NEXT

How a Web Page Gets Made

Using a sign-up page for a seafood dinner: walls, paint, switches, a shared notebook and a street address, no code required.

No. 1 · 5 minKeep going →
← Back to ELI5