Skip to content

DDoS mitigation

Volumetric, protocol and application-layer floods: how reflection amplifies an attack, why anycast edges absorb it, and how to keep a request flood away from the origin.

25 min6 steps

By the end you can
  • Classify an attack as volumetric, protocol or application layer and match it to a defence
  • Estimate the bandwidth of a reflection and amplification attack
  • Explain how anycast and edge capacity absorb volumetric attacks, and estimate per-location load
  • Mitigate application-layer floods with edge caching, rate limits, challenges and a hidden origin

Three kinds of flood

A DDoS exhausts one resource from many sources. The resource picks the defence.

Volumetric

  • Fills links (Gbit/s)
  • Often UDP reflection
  • Only a bigger network absorbs it

Protocol

  • Fills connection state (packets/s)
  • SYN flood

Application

  • Valid but costly requests (req/s)
  • Looks like users

Your origin's CPU is at 100%, links are at 20%, and logs show millions of well-formed HTTPS search requests with random query strings from residential IP addresses. What kind of attack is this?

Answer this step to continue.