What is a botnet and how does it run a DDoS?
A botnet is a network of infected devices (computers, routers, IP cameras, IoT gear) remotely controlled by an attacker through a command-and-control (C2) server. On command, every bot sends traffic against a single target at once — the core of distributed denial-of-service (DDoS) attacks, where 'distributed' is exactly the power of thousands of sources striking simultaneously.
Why are botnets so dangerous?
Because traffic comes from thousands of legitimate IPs around the world, telling bots apart from real users and blocking them without harming the service is very hard. Botnets like Mirai proved that misconfigured IoT devices — with default passwords — can be recruited by the millions and generate hundreds of Gbps or Tbps attacks capable of taking down entire infrastructures.
How to defend against a botnet attack?
Defense combines edge mitigation (anti-DDoS services with absorption and scrubbing capacity), rate limiting, IP reputation lists and behavioral analysis to separate human from automated traffic. On the prevention side, keep your own devices from becoming bots: change default credentials, update firmware and segment IoT equipment.
How a botnet is built and controlled
Recruitment is almost always automatic: mass internet scanning for devices with default credentials, exposed services or unpatched vulnerabilities. Once inside, the implant registers with a command-and-control infrastructure. Early botnets used IRC channels, easy to locate and dismantle; current ones use HTTP or HTTPS to blend into normal traffic, domain generation algorithms producing thousands of candidate names a day, and peer-to-peer topologies with no central server, precisely so that taking down one node does not end the network.
Mirai and IoT: why the scale changed
In 2016 Mirai proved that compromising computers was unnecessary: IP cameras, video recorders and home routers still carrying factory passwords were enough. Its default-credential list held barely a few dozen entries and still recruited hundreds of thousands of devices, generating attacks above one terabit per second against a DNS provider and knocking much of the internet offline. When its source code was published, countless variants appeared, and that model — cheap devices, no updates, permanently connected — remains the foundation of today's botnets.
How do you know if your devices are part of one?
The signals show up on the network rather than the device: outbound traffic at hours with no human activity, periodic regular connections to one unknown destination, DNS queries for randomly named domains, and upload bandwidth spikes on equipment that should only receive data. On the devices themselves, slowness or heat with no cause. Effective prevention is unglamorous: change factory credentials, keep firmware current, close remote administration and put IoT on a network separate from the corporate one.
