Although a botnet uses many zombie computers to launch an attack, botnet traffic has a typical pattern. The botnet’s main purpose is usually a DDoS attack and these have standard formats. Some DDoS attack strategies, such as reflection attacks are not found in botnet activity because the traffic volume created by the zombie computers is enough to disable a Web server’s ability to serve legitimate requests without the need for an external third-party service. So, botnet detection systems look at traffic patterns and packet structures rather than the source addresses of that traffic.