content: How do people combat this?   Usually by having a lot of extra capacity.  Either themselves (Google, Amazon, etc.) or hiring someone else to do it for you (Cloudflare, etc.).  Also, noticing things that the attackers have in common that real users don't and taking advantage of those things to filter out the attacker's traffic.     Do the attackers eventually just give up?  Yes.  Most DDoS attacks are done by botnets for hire these days.  So, people literally pay by the hour for a DDoS of a given magnitude.  OTOH, DDoS attacks by people who run their own botnets usually last until the attacker gets bored.  If the attack is having no noticable effect, they usually get bored pretty quickly.  Especially because the bots are much more likely to get cleaned up for being "slow" when they're part of an active attack.