We know what the results of a DDoS attack look like: huge disruption, brand damage, and potential revenue loss of tens of thousands of dollars per hour. But what does the attack itself look like?

This video visualization, filmed in Neustar’s Security Operations Center, shows the first three minutes of an actual DDoS attack on a company’s Transmission Control Protocol Synchronize (TCP SYN) authentication. This type of attack can overwhelm a server’s available TCP connections with phony requests.

In the video, the dots move from the network blocks shown on the left toward the attack target. The colors of the dots are randomly assigned to participating IP addresses or IP address groups. Each dot represents a web event directed at the target during the given time.

Filmed in Neustar’s Security Operations Center, this video shows the first three minutes of an actual DDoS attack on a company’s Transmission Control Protocol Synchronize (TCP SYN) authentication. This type of attack can overwhelm a server’s available TCP connections with phony requests. On the far lower right corner of the screen, a log counter tallies the number of log events shown in this example. Note that the first 30,000 log events happening during the first three minutes of this specific DDoS attack. As a size reference, the full attack would have millions of events.

At some points, the traffic grows dense and bombards the target, and at other times it decreases and fewer dots appear.

On the far lower right corner of the screen, a log counter tallies the number of log events shown in this example. Note that the first 30,000 log events happening during the first three minutes of this specific DDoS attack. As a size reference, the full attack would have millions of events.

Be Ready: 7 Best Practices for How to Prevent DDoS Attacks