DDoS Flood Protection Technical Brief

Our DDoS Flood Protection service offers lightweight, effective DDoS mitigation specifically designed to protect against volumetric DDoS attacks, which represent 60% to 70% of all network attacks.

These attacks overwhelm your network by directing large volumes of malicious traffic, often through reflection or amplification techniques.

We mitigate the threat by diverting all incoming traffic, preventing the attack from causing widespread disruption.

How it works

Our service provides protection against outbound access to the internet (excludes any publicly accessible applications).

We monitor traffic in real-time, identifying any unusual spikes or patterns that may indicate an incoming attack.

When malicious traffic is detected, we redirect it to prevent it from reaching your infrastructure.

Once the attack subsides, our system automatically reroutes traffic back to normal operation without any manual intervention.

Attack detection

We have an automatic detection system monitoring for suspicious traffic based on thresholds learned during the onboarding period.

In the unlikely event we do not detect the attack, we can place a manual mitigation and respond within SLA times.

If we detect an attack, we will proactively apply mitigations and provide a notification. If the attack is not detected, once reported, we will respond within the agreed SLA timeframe.

Protection against common volumetric attack types

• Reflection attacks where spoofed IP addresses are used to reflect traffic back to your network, flooding it with illegitimate traffic.

• Amplification attacks where attackers exploit vulnerable protocols to amplify traffic, overwhelming your resources.

• Packet fragmentation attacks where attackers overwhelm the network by sending fragmented packets that the target system must reassemble, using up processing power and bandwidth.

• TCP stack attacks exploit weaknesses in the TCP protocol to overwhelm the ability to handle legitimate TCP connections. They often target the protocol layer directly, rather than relying on reflection or amplification.

This service does not protect against direct path, protocol or application attacks. For details on our protection service against these, refer to DDoS Protection Technical Brief.