Volumetric and protocol floods are the blunt instruments of the DDoS world—and they still work. A SYN flood can exhaust a server’s connection table; a UDP or ICMP flood can fill your uplink with pure noise. The difference between a shrug and an outage is often just how fast you notice. This is where flow telemetry earns its keep. Here’s how the common floods work and how to catch them in real time.

Diagram of a distributed flood attack with many attacker sources sending flood traffic through ISP networks to saturate a single victim's link
Floods win on volume and speed—detection has to be faster.

The floods you need to recognize

  • SYN flood. A storm of TCP SYN packets (often spoofed) opens half-connections the server must hold open, exhausting its state table. The fingerprint: a surge of SYNs with few completing handshakes.
  • UDP flood. High-rate UDP packets, frequently to random ports, that force the target to churn generating “port unreachable” replies and simply saturate the pipe.
  • ICMP flood. A deluge of ping/echo traffic consuming bandwidth and CPU.
  • ACK/RST flood. Floods of TCP ACK or RST packets that bypass simple SYN-based defenses and hammer stateful devices.
  • HTTP flood. A wave of seemingly legitimate requests aimed at exhausting application resources.

Why sFlow is built for this

Floods are, by definition, high-volume and sudden—which plays directly to sFlow’s strengths. Sampling in hardware means even a 100G flood doesn’t blind your switch, and the real-time streaming means you see the rate climb the instant it starts, not after a flow cache flushes. The signal is loud: packet rates and connection patterns spike far past anything normal, with lopsided flag ratios (all SYN, all ACK) that legitimate traffic never shows.

Turn the signal into an alert

BackendSide sFlow Collector & Analyzer includes dedicated flood detectors—SYN, UDP, ICMP, ACK/RST, and HTTP—each watching your live sFlow feed for the rate and pattern that defines that attack. Instead of eyeballing a bandwidth graph and hoping, you get an alert with the target, the source pattern, and a severity tier, in the seconds that matter. And because alerts are grouped into episodes, a flood shows up as one escalating event with an occurrence count—not ten thousand duplicate rows burying your console.

BackendSide sFlow Threat Overview page showing port-scan suspects ranked by scanner with ports, targets and severity, a SYN flood indicators panel, and a severity distribution breakdown
The Threat Overview surfaces flood and scan indicators with severity tiers—clear signal, not a wall of noise.
🔧 BackendSide Tool

BackendSide sFlow Collector & Analyzer — Turn a Flood Into a Single Actionable Alert

BackendSide sFlow Collector & Analyzer includes dedicated flood detectors — SYN, UDP, ICMP, ACK/RST and HTTP — each watching your live sFlow feed for the rate and pattern that defines that attack. You get an alert with the target, the source pattern and a severity tier in the seconds that matter, and because alerts are grouped into episodes, a flood shows up as one escalating event with an occurrence count instead of ten thousand duplicate rows.

Explore BackendSide sFlow Collector & Analyzer →

The bottom line

Floods aren’t subtle—they’re fast. The winning move is early detection, and flow telemetry gives you exactly that: a real-time view that lights up the moment traffic stops looking like traffic and starts looking like an attack. Pair it with detectors built for each flood type, and you turn “why is everything down?” into “we saw it at packet one.”