New DDoS Record: 809 Million Packets Per Second

On June 21, 2020, cybersecurity experts at Akamai reported that a major European bank (whose name was not disclosed) became the target of one of the most powerful DDoS attacks in history. While the attack’s bandwidth peaked at 418 Gbps, what truly set it apart was the record-breaking rate of 809 million packets per second (PPS).

Understanding DDoS Attack Metrics

DDoS (Distributed Denial of Service) attacks can be measured in several ways: bits per second (BPS), packets per second (PPS), or requests per second (RPS). Attacks with high BPS are typically aimed at overwhelming internet bandwidth, PPS attacks target network devices and cloud/data center applications, and RPS attacks usually focus on edge servers running web applications.

Details of the Attack

According to researchers, the incident was brief, lasting about 10 minutes, but the attack ramped up to dangerous levels extremely quickly. It took only a few seconds for normal traffic to surge to 418 Gbps, and about two minutes to reach the peak of 809 million PPS.

Experts believe a new botnet was behind this incident, making its presence known for the first time. This conclusion is based on the large number of IP addresses involved—96.2% of which were previously unknown to Akamai analysts. During the attack, the number of IP addresses observed for this client increased 600-fold.

A New PPS Record

Akamai states that this is a new record for PPS-based DDoS attacks. The previous record, set earlier in June 2020, was 385 million PPS—meaning the new attack more than doubled the previous high.

Experts also noted that the attack was clearly optimized to bypass DDoS protection systems, focusing specifically on maximizing PPS. The malicious packets sent had a payload of just 1 byte, with a total packet size of 29 bytes (including IPv4 headers), making them difficult to detect among billions of peers.

Comparisons with Other Recent Attacks

This is the second DDoS record broken in June 2020. Earlier in the month, Amazon AWS Shield mitigated a BPS-based attack that reached 2.3 Tbps. While the Akamai incident’s 418 Gbps may seem less impressive by comparison, it’s important to note the difference in attack types. According to Amazon’s statistics, the largest PPS attack they recorded this year was 293.1 million PPS—2.7 times less than the attack Akamai faced.