&gt;Layer 7 attacks are the new hotness in DDoS<p>Maybe 10 years ago.<p>&gt;Fundamentally, layer 3&#x2F;4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3&#x2F;4 might get addressed by BCP 38, Vixie&#x27;s good fight, etc., but not holding my breath.<p>Sending &quot;raw&quot; UDP floods from bots still has several benefits over amplification attacks provided you can amass enough bandwidth, which isn&#x27;t that difficult these days.<p>&gt;By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks.<p>Unlikely, it&#x27;ll take a fundamental change on how networks work for network layer attacks to become irrelevant. Especially considering volumetric attacks have the added benefit of potentially getting your target kicked off by their hosts and causing added damage in BW bills. And as internet connections become faster, DDoS attacks become bigger.