96% of DDoS attacks are under 500 Mbps: what H1 2026 data says about the attacks that actually hit small networks

When people picture a DDoS attack, they picture the record breakers: terabits per second, entire regions knocked offline, front page coverage. Cloudflare's DDoS Threat Report for the first half of 2026 (published 11 August 2026) says the attack you are statistically most likely to face looks nothing like that.

The headline numbers

: Cloudflare mitigated 23.2 million network layer DDoS attacks in January through June 2026, roughly 5,343 per hour or about 128,000 per day.
: 96.62% of network layer attacks stayed under 500 Mbps.
: 90.60% of them ended in under 10 minutes.
: At the other extreme, 935 network layer attacks exceeded 1 Tbps in the half year, with 805 of those landing in Q2 alone.

So the distribution is extremely lopsided: a very small tail of enormous attacks, and an overwhelming majority of small, brief bursts.

Why "small" is not the same as "harmless"

Cloudflare's own framing is worth repeating: small is relative. Their report notes that a 100 Mbps attack is enough to overwhelm a server or website, and a 100 Gbps attack can take most unprotected data centers offline. If your site sits behind a single business fibre line, a sub 500 Mbps burst is not a rounding error. It is your entire uplink.

The duration figure is the operationally important one. If nine out of ten attacks are over within 10 minutes, then any process that depends on a human noticing an alert, opening a ticket and calling an ISP has already lost. The report is blunt about this: by the time an alert reaches an analyst, the attack has finished. What is left is the aftermath, things like routing instability, TCP retransmissions and application timeouts that can drag on well past the attack window.

The methods shifted too

: DNS based attacks (DNS Flood plus DNS Amplification) made up 34.3% of network layer attacks in H1 2026, with DNS Floods alone rising from 25.7% to 40.0% quarter over quarter.
: CLDAP Floods grew 580% quarter over quarter to become the number 3 vector in Q2. CLDAP abuses Active Directory LDAP over UDP on port 389: attackers send small spoofed queries to publicly reachable domain controllers, which reply to the victim with far larger responses.

That last one is a direct hygiene lesson. If a domain controller is reachable from the public internet on UDP 389, it is not just an exposure risk for you. It is amplification capacity for somebody else's attack.

What this changes for a small network

: Assume detection and response have to be automatic, because 10 minutes is not a human timescale.
: Audit what of yours is reachable from the internet, especially UDP services that reply with more data than they receive.
: Treat authoritative DNS as a dependency worth protecting, not as an afterthought.

Source: Cloudflare DDoS Threat Report H1 2026, Cloudforce One, 11 August 2026. https://blog.cloudflare.com/ddos-threat-report-2026-h1/

https://store.zyxel.com