The last big DDOS attack used a bug in the timeserver software which has since been patched. They spoofed their IP address so it was the same as the site they wanted to attack and asked the timeserver software for a time update which is usually only a few bytes long, but they asked for the verbose version which was a few kb long. So say they sent the request which was 6 bytes and the server sent the reply of 6kb (6000 bytes) to the IP address they spoofed (say googles ip address) but then they immediately re requested the same info again sending 6 bytes to get another 6000bytes sent to google and again, over and over. Now set that same thing happening on say 100 Borged (hijacked) computers to do the same. Eventually no one can get to the google webpage because the server is flooded with these time updates that it never asked for. 6000bytes x 100 =600000bytes per second per second for an outlay of 600bytes coming from the borged computers. Of course 100 computers wont get you far, but they used thousands of computers around the world. This sort of thing is going on all the time, but the ISP's have ways to combat it. Have a look at http://www.digitalattackmap.com for the latest graphics of attacks and the historic ddos attacks last year.

Not really. It just floods the target until all real traffic gets lost in the overflow.

How does Google work? You just enter what you want to know and you learn things.