Attack class
Carpet Bombing
Last updated: August 2026 · Spread so no threshold fires · Reading time ~8 min
Carpet bombing distributes attack traffic across many addresses in a target prefix rather than concentrating it on one. No single destination crosses a per-host threshold, so detection tuned per address stays silent while the aggregate fills the circuit. It is a detection problem first, and it makes the usual blunt response expensive.
What it exhausts
The shared circuit, and the detection logic before it.
The attack is defined by its distribution rather than its content. The individual vectors are ordinary — reflection, UDP flood, SYN flood — and what makes the campaign distinct is that no destination is meant to be the destination.
How it differs from similar attacks
A conventional volumetric attack concentrates on one target and is trivially visible in per-host telemetry. Carpet bombing produces the same aggregate volume and is invisible in exactly that telemetry, which is the entire design.
The difference shows up most sharply in the response. Against a concentrated attack, RTBH is a clean if painful answer. Against a spread one it is either ineffective or self-destructive.
Observable telemetry
- Aggregate inbound volume rising with no single destination crossing its threshold.
- Distinct-destination count rising sharply — the definitive signal.
- Traffic to addresses that host nothing, which a per-host view has no reason to examine.
- Circuit utilisation climbing while every per-service graph looks normal.
The last point is worth dwelling on: this is an attack that presents as “the link is full and nothing is wrong”, which is exactly the state an operations team is least equipped to interpret quickly.
Common false positives
Large-scale scanning produces a similar destination-cardinality signature at much lower volume. Legitimate address-space-wide activity — a monitoring sweep, a migration, a new service coming online across a range — can also raise distinct-destination counts.
Volume and cardinality together separate them; either alone does not.
Mitigation by layer
Detection first. Nothing else matters until aggregation happens at prefix level rather than per host. This is a configuration question in most products and a capability question in some, and it is the specific thing to test.
Upstream, at the aggregate. A FlowSpec rule matched on protocol and source port across the whole prefix removes the vector without sacrificing any destination — the strongest available answer, and dependent on what your carrier accepts.
Scrubbing, which handles the volume without requiring you to identify which address matters.
RTBH as the last resort, understanding that the sacrifice grows with the spread.
Operational pitfalls
Chasing addresses. Blackholing one target at a time during a spread campaign is a losing race that also consumes the operator’s attention.
Prefix-level blackholing under pressure, which is a self-inflicted outage across every service behind it. It is occasionally correct and it should be a level-3 decision with a named owner, as the escalation matrix sets out.
Per-tenant thresholds in a multi-tenant estate, where the same blindness applies per customer rather than per host.
Safe validation
The test that discriminates is the rotating-subset test: generate traffic across a changing set of destinations within your own prefix, staying below saturation, and confirm the detection raises an event based on aggregate and cardinality rather than per-host volume. A product that only alerts when one address crosses a threshold has told you something important.
The full carpet-bombing mitigation guide works through the procurement questions and the rulebook language in detail.
Frequently asked questions
- Why do normal thresholds miss it?
- Because they are usually expressed per destination address. If a threshold fires at 1 Gbps to one host, spreading 10 Gbps across two hundred hosts puts 50 Mbps on each — well under the limit on every one of them, while the shared circuit is full. The detection has to aggregate at prefix level to see it at all.
- Why is blackholing a bad answer here?
- Because the sacrifice scales with the spread. Blackholing one address stops a fraction of the attack; blackholing the whole prefix takes down everything you run. It is the one attack class where the blunt instrument is close to useless — you either play whack-a-mole or take yourself offline.
- What detection signal actually works?
- Distinct-destination cardinality. The number of individual addresses receiving traffic in a window is the property that changes, and it changes sharply. Aggregate volume plus destination count together separate this from a general traffic rise.
- Does this affect enterprises or only operators?
- Anyone with a prefix rather than a handful of addresses, which in practice means operators, hosting providers and larger enterprises. An organisation with a single public address cannot be carpet bombed — there is nothing to spread across.
Published: August 2026 · Last reviewed: August 2026
Reviewed means the sources above were re-read on that date; the text is only reissued when something material changed.
This guide is updated as vendors release new models and pricing. How we compare vendors