The DDoS attack on Dyn by Mirai malware that disrupted the internet was largest of its kind in history. Experts say that its strength was 1.2 Tbps. I don't understand the math behind it. How is the strength of a DDoS attack calculated?
It sometimes is hard to measure the exact size of a DDoS attack. When links get saturated you can't tell from the victim's perspective how much more traffic was sent to your network than your network's links could handle. If your network has a 100Gbps uplink, you can't tell the difference between a 100Gbps attack and a 1.2Tbps attack from within your network, since the effect is the same: the link is saturated.
The only place you can check that is at the upstream networks of the network under attack. But it can be the case, especially with enormous attacks as on Dyn, that even links on their network get saturated, so you'd have to check statistics for traffic towards the victim of the DDoS on their upstream networks as well.
Calculating the exact size of the attack may get even more complex when networks between the attackers and the victim are filtering some of the DDoS traffic. Some network automatically filter or rate limit known bad outbound traffic from their network, so it never even reaches the network under attack or its upstreams.
To sum it up: it's hard to give an exact measurement of the size of a (large) DDoS attack, but by aggregating statistics of the network under attack and its upstreams you can make an educated guess.
Tbps or terabits per second. Is a measure of the amount of data being sent every second. bits and bytes differ in that a byte is 8 bits, and a bit is basic binary, either 1 or 0. here we are dealing with bits. 1000 bits = 1 kb or kilobit. 1000 kb = 1 mb or megabit 1000 mb = 1 gb or gigabit 1000 gb = 1 tb or terabit. so from this you can kind of get a scope of the amount of data being sent per second. it's calculated likely from logs off internet backbone routers or even real time monitoring of traffic. No rocket science here.