Security
What is DDoS?
A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity. Volumetric attacks at layers 3 and 4 are stopped by upstream scrubbing; application-layer attacks at layer 7 send requests that look legitimate and need protocol-aware filtering.
Why DDoS matters
Volumetric attacks at layers 3 and 4 are stopped by upstream scrubbing; application-layer attacks at layer 7 send requests that look legitimate and need protocol-aware filtering.
DDoS in practice
When a DDoS hits your box, you watch three things first: ingress bandwidth on the provider's side, connection table utilisation, and whether the load is sockets or CPU. With always-on L3/L4 scrubbing up to 12 Tbps included, most volumetric noise never reaches you. For L7 floods that look like real requests, you add DDoS Pro at $9/month and tune filtering. Get it wrong and you are down during the attack window, burning hours while your service is unreachable.
What people get wrong about DDoS
People think DDoS is a bandwidth problem only, so they buy a bigger pipe and call it done. Correction: many attacks are connection-state or application-layer — they exhaust your conntrack table or keep your CPU parsing legitimate-looking requests. Scrubbing at layers 3 and 4 does not stop those; you need protocol-aware filtering at layer 7.
DDoS — common questions
How much DDoS protection is included?
Every plan includes always-on DDoS mitigation with up to 12 Tbps of edge scrubbing capacity. That handles volumetric L3/L4 attacks. For application-layer attacks at L7, you can add DDoS Pro at $9/month for additional filtering on top.
Why does my server still go down during a DDoS?
Volumetric attacks are scrubbed upstream before reaching your instance, but layer 7 attacks send requests that look legitimate. They slip past L3/L4 filters and overwhelm your application. You need L7 protection, like DDoS Pro, plus your own application-level rate limiting.
Where DDoS comes up
- What is included in every plan? Full root access, KVM virtualisation with custom kernel support, custom ISO upload, an out-of-band VNC console, one IPv4 address, a routed IPv6 /64, always…
- What makes OnionVPS different from other VPS providers? Four things: no identity verification of any kind, crypto-only payment with no card or bank involved, 138 locations in 116 countries including genuine offs…
- Are there setup fees or hidden charges? No setup fee, no provisioning charge, and no bandwidth overage billing. The plan price includes the transfer allowance, DDoS mitigation, one IPv4 address, …
- What is DDoS protection and do I need it? DDoS protection filters attack traffic upstream of your server so legitimate requests still arrive. It has to be always-on to be useful — mitigation that a…
- Network DDoS protection vs a CDN proxy Network-level scrubbing filters attack traffic upstream of your server at layers 3 and 4, and it works for any protocol — game servers, DNS, mail, anything…
More from security
- LUKS
- LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself.
- Traffic scrubbing
- Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones.
- Null route
- A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.
- fail2ban
- fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses.