Security

What is DDoS?

Also known as: distributed denial of service
Definition

A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity. Volumetric attacks at layers 3 and 4 are stopped by upstream scrubbing; application-layer attacks at layer 7 send requests that look legitimate and need protocol-aware filtering.

Why DDoS matters

Volumetric attacks at layers 3 and 4 are stopped by upstream scrubbing; application-layer attacks at layer 7 send requests that look legitimate and need protocol-aware filtering.

DDoS in practice

When a DDoS hits your box, you watch three things first: ingress bandwidth on the provider's side, connection table utilisation, and whether the load is sockets or CPU. With always-on L3/L4 scrubbing up to 12 Tbps included, most volumetric noise never reaches you. For L7 floods that look like real requests, you add DDoS Pro at $9/month and tune filtering. Get it wrong and you are down during the attack window, burning hours while your service is unreachable.

What people get wrong about DDoS

People think DDoS is a bandwidth problem only, so they buy a bigger pipe and call it done. Correction: many attacks are connection-state or application-layer — they exhaust your conntrack table or keep your CPU parsing legitimate-looking requests. Scrubbing at layers 3 and 4 does not stop those; you need protocol-aware filtering at layer 7.

DDoS — common questions

How much DDoS protection is included?

Every plan includes always-on DDoS mitigation with up to 12 Tbps of edge scrubbing capacity. That handles volumetric L3/L4 attacks. For application-layer attacks at L7, you can add DDoS Pro at $9/month for additional filtering on top.

Why does my server still go down during a DDoS?

Volumetric attacks are scrubbed upstream before reaching your instance, but layer 7 attacks send requests that look legitimate. They slip past L3/L4 filters and overwhelm your application. You need L7 protection, like DDoS Pro, plus your own application-level rate limiting.

More from security

LUKS
LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself.
Traffic scrubbing
Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones.
Null route
A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.
fail2ban
fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses.