What is the traffic volume of practical DDoS attacks

Question

I wonder what is the volume of traffic, in terms of requests/second, forms a legit DDoS attack against a website. I know it highly depends on the website and where it is hosted. But is there any real-world example that at least gives some numbers. For example, for 10M request/second, what size of website can be taken down?

I can only find some online news such as GitHub Survived the Biggest DDoS Attack Ever Recorded, but it is not very easy to interpret the unit they use, i.e., 1.3 Tbps, into number of HTTP requests from technical point of view. If interpret literally, one regular HTTP request include tens of headers that may range from few hundreds to few thousands of characters, and then count for a few thousands Bytes and then tens of thousands bits. If calculate this way, assuming a request is with size 5Kb on average, then 1.3 Tb would be roughly 200 million requests. But I don't think it is the right way to consider.

Answer 1

Link11 (a European security firm providing DDoS protection) reports that in 2020 the bandwidth of an average attack to their customers was about 5 Gbps, and the maximum bandwidth was about 400 Gbps. Source: https://www.helpnetsecurity.com/2020/04/20/ddos-attacks-increasing/

A recent post on Cloudflare's blog reports that over 60% of the attacks are under 500 Mbps, and almost 30% of the attacks are between 500 Mbps and 10 Gbps. The largest attack they have seen recently was about 550 Gbps. Source: https://blog.cloudflare.com/ddos-attacks-have-evolved-and-so-should-your-ddos-protection/

What does that tell you? Not much. It just tells you that cyber criminals can afford a lot of bandwidth, but most of the time the attacks just need a few Gbps to be effective. From the above article by Cloudflare:

Even though 10 Gbps from an attack size perspective does not seem that large, it is large enough to significantly affect a majority of the websites existing today".

It's difficult to come up with specific examples or general answers to your questions though. There are a lot of different types of DoS attacks, at different levels and with different techniques. Some use empty packets, other use specific packets, other target specific high-level protocols, other focus on the application rather than the network, and so on. So if you have a 10 Gbps attack, that's 10 Gbps of... what? Bogus TCP packets? SMTP connections? HTTP requests to a large image file? HTTP POST requests to run a cpu-intensive task? Who knows. So your question is way too broad.