DDoS protection is not a single product. It is an ecosystem of overlapping technologies, each designed to handle a specific aspect of attack detection, traffic diversion, and mitigation. Understanding the full landscape is essential for building a defense strategy that actually works when your infrastructure comes under fire.
This guide walks through every category of DDoS protection and mitigation solution available today, explains how each approach works at a technical level, and helps you understand which combinations make sense for different infrastructure types.
The Three Layers of DDoS Defense
Before diving into specific solutions, it helps to understand the three fundamental layers where DDoS protection operates:
- Upstream (network edge) - Protection that sits between the internet and your infrastructure, filtering traffic before it reaches you
- Perimeter (your network edge) - Appliances or software that inspect traffic as it enters your network
- Host (individual servers) - Agents or services running on each server that detect and respond to attacks at the OS level
Most organizations need coverage at a minimum of two layers. The strongest defenses cover all three. Each layer catches attacks that the others might miss, and together they form a defense-in-depth strategy that leaves no blind spots.
Cloud Scrubbing Services
Cloud scrubbing is the most common form of upstream DDoS protection. When an attack is detected (or permanently, in always-on mode), traffic is rerouted to a cloud provider's scrubbing centers via BGP announcements or DNS redirection. The scrubbing center inspects each packet, drops malicious traffic, and forwards legitimate traffic to your origin.
How It Works
In a typical BGP-based deployment, the scrubbing provider announces your IP prefixes from their network. All internet traffic destined for your IPs flows through their infrastructure first. Their systems apply a combination of rate limiting, signature matching, behavioral analysis, and protocol validation to separate attack traffic from legitimate requests. Clean traffic is tunneled back to your origin via GRE or IPsec.
Strengths and Weaknesses
Cloud scrubbing excels at absorbing massive volumetric attacks. The largest providers operate networks exceeding 100 Tbps, which means they can absorb floods that would overwhelm any single data center. However, scrubbing introduces latency (typically 5-20ms per hop), requires BGP configuration expertise, and provides limited visibility into what happens on your actual servers.
The biggest weakness of cloud scrubbing is the detection gap. If the provider uses on-demand activation (rather than always-on), there is a delay between attack onset and traffic rerouting. This delay can range from 30 seconds to several minutes, during which your infrastructure absorbs the full attack.
CDN-Based Protection
Content Delivery Networks like Cloudflare and Fastly offer DDoS protection as a byproduct of their proxy architecture. When you point your DNS at a CDN, all HTTP/HTTPS traffic passes through their edge servers. These servers can detect and drop malicious requests before they reach your origin.
How It Works
CDN-based protection operates at Layer 7 (application layer) by default. The CDN terminates TLS connections, inspects HTTP requests, applies rate limiting and challenge pages, and only forwards legitimate requests to your origin. Some CDNs also offer Layer 3/4 protection through separate products (like Cloudflare's Magic Transit).
Strengths and Weaknesses
CDN protection is easy to deploy (just change your DNS records) and often available on free or low-cost tiers. It works well for web applications and APIs. However, it only protects traffic that flows through the CDN. If an attacker discovers your origin IP, they can bypass the CDN entirely. Non-HTTP protocols (gaming, VoIP, custom UDP) are not covered by standard CDN protection.
BGP-Based Diversion (FlowSpec and RTBH)
BGP FlowSpec and Remote Triggered Black Hole (RTBH) routing are network-level mitigation techniques that operate at the router level. They allow you to instruct upstream routers to drop or rate-limit specific traffic patterns.
BGP FlowSpec
FlowSpec lets you propagate firewall-like rules through BGP. Instead of simply routing all traffic for a prefix to a scrubbing center, you can specify rules like "drop all UDP traffic from source port 19 to destination port range 10000-20000." These rules propagate to every BGP-speaking router that accepts your FlowSpec announcements, effectively creating a distributed firewall.
RTBH
RTBH is a simpler technique where you announce a route for a targeted IP that directs traffic to a null interface (black hole). This stops the attack from reaching your network but also drops all legitimate traffic to that IP. It is a last resort that sacrifices availability for one IP to protect the rest of your infrastructure.
Both techniques require BGP peering with your upstream provider. Flowtriq supports both BGP FlowSpec and RTBH as automated mitigation actions, allowing you to trigger these responses within seconds of attack detection.
On-Premise Hardware Appliances
Hardware-based DDoS mitigation appliances sit inline at your network perimeter. Products like Radware DefensePro and NETSCOUT Arbor Edge Defense inspect every packet entering your network and apply real-time filtering.
How It Works
Inline appliances use a combination of signature matching, behavioral analysis, and rate limiting. They operate at line rate using specialized ASICs or FPGAs, which means they can process traffic at 10/40/100 Gbps without introducing significant latency. When an attack is detected, the appliance drops malicious packets while allowing legitimate traffic to pass.
Strengths and Weaknesses
Hardware appliances offer the lowest detection and mitigation latency of any solution category, often under one millisecond. They provide full packet visibility and do not require sending your traffic to a third party. However, they are expensive (typically $50,000-$500,000), require physical rack space, and can only handle attacks smaller than your upstream bandwidth. If the attack saturates your internet link before reaching the appliance, the appliance is useless.
Host-Level Detection and Mitigation
Host-level solutions run directly on each server, monitoring traffic at the operating system level. This approach provides the most granular visibility because it sees exactly what each server experiences, regardless of how traffic reaches it.
How It Works
A lightweight agent monitors packets per second, connection rates, and protocol distributions at the kernel level. It establishes a baseline of normal traffic for each server and raises alerts when anomalies are detected. Advanced agents like Flowtriq also classify attacks by type, capture PCAP data for forensics, and trigger automated mitigation responses.
Strengths and Weaknesses
Host-level detection catches every attack that reaches your servers, regardless of whether it bypassed upstream protections. It provides per-server granularity that network-level solutions cannot match. Detection latency can be as low as one second (Flowtriq achieves this with kernel-level PPS monitoring). The main limitation is that host-level tools cannot stop attacks from consuming your upstream bandwidth. They are best paired with an upstream solution that handles volumetric absorption.
Flow-Based Detection (NetFlow/sFlow)
Flow-based detection systems analyze NetFlow or sFlow data exported by network switches and routers. Rather than inspecting individual packets, they work with aggregated flow records that summarize traffic patterns.
How It Works
Network devices sample packets (typically 1-in-1000 or 1-in-4096) and export flow records to a collector. The collector analyzes these records for anomalies like sudden traffic spikes, unusual protocol distributions, or unexpected source IP ranges. When an anomaly is detected, the system triggers an alert or automated mitigation action.
Strengths and Weaknesses
Flow analysis scales well to large networks because it works with sampled data rather than full packet captures. It provides network-wide visibility from a centralized collector. However, sampling introduces latency (30-60 seconds minimum) and can miss short-burst attacks entirely. Small attacks that fall below the sampling threshold go undetected. There is no packet-level forensic data available.
Auto-Mitigation and Orchestration
Modern DDoS defense increasingly relies on automated response. When an attack is detected, the mitigation system should react without waiting for a human operator.
Common Auto-Mitigation Actions
- Local firewall rules - Applying iptables or nftables rules to drop attack traffic at the server level
- BGP FlowSpec - Propagating filtering rules to upstream routers
- RTBH - Black-holing the targeted IP as a last resort
- Cloud scrubbing activation - Triggering on-demand cloud scrubbing via API
- Rate limiting - Applying per-source or per-protocol rate limits
- GeoIP blocking - Dropping traffic from regions that should not be accessing your services
Flowtriq supports all of these actions through its auto-mitigation engine. You define rules that match specific attack types, thresholds, and conditions, and Flowtriq executes the appropriate response automatically. This includes escalation logic, so if local iptables rules do not stop the attack, Flowtriq can escalate to BGP FlowSpec or cloud scrubbing.
Multi-Channel Alerting
Detection without notification is useless. Your team needs to know about attacks instantly, through whatever channels they already monitor.
Modern DDoS detection platforms should support at least:
- Email notifications with attack details and classification
- Slack and Discord for ChatOps workflows
- PagerDuty and OpsGenie for on-call escalation
- SMS for critical alerts
- Webhooks for custom integrations
- Datadog and other monitoring platforms for centralized observability
Flowtriq supports all of these channels natively, plus Telegram. Alerts include the attack type, affected node, traffic volume, and a link to the incident dashboard with PCAP data.
Building a Complete Protection Strategy
No single solution covers every attack vector. The most effective strategies layer multiple approaches:
- Host-level detection on every server for instant awareness (Flowtriq provides this)
- Automated local mitigation for attacks your servers can absorb (iptables/nftables rules)
- BGP-based diversion for attacks that overwhelm local capacity (FlowSpec or RTBH)
- Cloud scrubbing for massive volumetric attacks that exceed your total upstream bandwidth
- CDN protection for HTTP/HTTPS workloads as a first line of defense
The key is detection speed. Every second between attack onset and mitigation activation is a second your infrastructure is degraded. By starting with host-level detection that operates in one second, you ensure that every subsequent layer is triggered as fast as possible.
Pricing and Cost Considerations
DDoS protection costs vary enormously. Cloud scrubbing services typically start at $3,000-$10,000/month for meaningful coverage. Hardware appliances require $50,000+ in capital expenditure plus ongoing maintenance contracts. Enterprise detection platforms often bundle into six-figure annual agreements.
Flowtriq provides production-grade detection, classification, alerting, and auto-mitigation starting at $9.99/node/month (or $7.99/node/year with annual billing). This makes it possible to protect every server in your fleet without an enterprise budget, and it pairs naturally with whatever upstream mitigation you already have in place.
Start With Detection That Actually Works
Flowtriq gives you 1-second detection, automatic attack classification, PCAP forensics, and multi-channel alerts across every node. Auto-mitigation with escalation from iptables to BGP FlowSpec to cloud scrubbing. Starting at $9.99/node/month.
Start your free 7-day trial →