The Record-Breaking 29.7 Tbps DDoS Attack

Recently, Cloudflare reported blocking a 29.7 Tbps DDoS attack — the biggest one ever recorded. For comparison, most huge attacks in the past few years were in the 1–3 Tbps range, so this one wasn’t just bigger… it was on a completely different level.

What Happened

The traffic came from a botnet called Aisuru, made up of millions of hacked IoT devices — things like cameras, routers, and random “smart” gadgets that people install and forget to secure. These devices were sending so much junk traffic that it peaked at:

• 29.7 terabits per second
• Around 14 billion packets per second
• Lasted roughly one minute

Even though it was short, an attack that size could knock almost any unprotected service offline instantly.

How the Attack Worked

Instead of hammering a single server, the attackers used a method called carpet-bombing — basically flooding entire IP ranges with UDP traffic. This makes it harder for defenders to know what to block without taking out real users.

The attack also randomized ports and packet types, making it tricky for filters and automated systems to react fast enough.

Why It Matters

This attack shows how quickly DDoS capability is growing. A few years ago, even 5 Tbps sounded huge. Now we’re getting close to 30 Tbps.

It also highlights a bigger problem:
The more IoT devices people plug into their homes, the bigger these botnets become. Many of these devices never get patched, so attackers have an endless supply of targets to infect.

Cloudflare’s Response

Cloudflare managed to absorb the traffic thanks to its global network, so customers didn’t notice anything. But smaller companies or self-hosted setups would have been completely overwhelmed.

Sources & References

• Cloudflare — “2025 Q3 DDoS Threat Report,” which confirms the 29.7 Tbps peak and describes the attack method. blog.cloudflare