DDoS Protection

How DDoS protection works: detection, scrubbing and clean traffic

A distributed denial-of-service attack floods a server with more traffic or requests than it can handle, sent from many machines at once. Those machines are usually hijacked computers, routers and connected devices pulled into a botnet without their owners noticing. DDoS protection sits between the internet and the target. It watches incoming traffic, flags what breaks from the usual pattern and diverts the flow to scrubbing centers, which drop the attack packets and forward the legitimate requests to the origin server.

Attacks fall into two groups, and a credible provider states which ones it covers. Volumetric and protocol attacks hit the network and transport layers with UDP floods, SYN floods, DNS or NTP amplification and fragmented packets, aiming to fill the server uplink or exhaust its connection table. Application-layer attacks target HTTP with requests that look like real visitors, or with deliberately slow connections in the style of Slowloris, until the web server and database give out. Network filtering handles the first group. The second calls for inspecting the requests themselves through per-address rate limiting, bot challenges or a web application firewall.

A firewall running on the server itself cannot stop a volumetric attack. By the time packets reach it, the link between the machine and the network is already saturated. Mitigation has to happen upstream, on a network with more capacity than the attack, which is why it is bought from an equipped host or a specialist provider.

Protected hosting, GRE tunnels and reverse proxies compared

The simplest option is a server rented from a host that filters its own network. Protection is active from day one with nothing to configure, and one invoice covers hosting and mitigation. Sharktech works this way, with DDoS filtering included on every service it hosts and higher capacity sold as an option. The trade-off is a migration: files, database and configuration all have to move.

Remote protection over a tunnel leaves the server where it is. Traffic for the site lands on the provider network first, gets cleaned and travels back to the server through a GRE or IPIP tunnel. The carrier-grade version requires announcing an IP block you own over BGP, which means an autonomous system number and a router that speaks BGP. Some providers skip all of that and lend their own addresses. X4B is one of them, and its service covers anything running over TCP or UDP, from game servers to mail as well as websites.

A reverse proxy is the easiest setup to reach. The domain points at the provider, which receives visitors and relays their requests to the origin server. It works with any hosting and takes a DNS change to put in place. Content delivery networks run on the same principle, and some offer a free tier that filters web traffic. Read their acceptable use terms before routing an adult site through them.

A site that is settled with a host that accepts adult content can keep that host and add a proxy or a tunnel. A site that is ready to move, or whose current host shuts the server off every time it gets hit, is better served by a protected server.

The factors behind DDoS protection pricing

Guaranteed mitigation capacity sets the base price: the attack volume the provider commits to absorbing for your address. The total network capacity quoted in marketing copy is shared by every customer and says nothing about that commitment. Plans bundled with a server include a baseline level and sell higher tiers as add-ons. Standalone remote plans are picked by tier from the start.

Remote plans often bill clean traffic too, meaning the volume or bandwidth of legitimate traffic that leaves the filter for your server, either on top of the mitigation capacity or instead of it. A video site burns through clean traffic far faster than a blog, so the tier follows the real audience of the site.

Always-on mitigation routes every packet through the provider at all times. It adds a detour but stops an attack from its first packet. On-demand mitigation diverts traffic only once an attack is detected. It costs less, and the opening of the attack reaches the server before the switch. Sharktech offers both modes for its remote protection, which has no public price.

A provider that scrubs traffic on several continents stops attacks close to their source and keeps latency reasonable for distant visitors. Routes to some regions, Asia in particular, are often capped under a fair use rule or billed separately. Application-layer filtering, the part that inspects HTTP requests, is sometimes sold as an option apart from network filtering.

Signs of a DDoS attack and the contract terms to check

A DDoS attack shows up as a slow or unreachable site with no code change behind it, and bandwidth or connection counts out of proportion to the visitors your analytics record. Server logs fill with requests from addresses scattered across many countries, often hitting the same page or sharing the same user agent. On a host without protection, the clearest sign is the site vanishing entirely: to shield the rest of its network, the host null-routes the targeted address and every packet is dropped, real visitors included.

A reverse proxy only protects the origin while its real IP address stays hidden. An attacker who finds it goes around the filter and hits the server directly. The address leaks through old DNS records, a subdomain still pointing at the server, or the headers of email sent from the machine. Once the proxy is in place, change the server address, send email through a separate service and allow only the provider addresses in the firewall.

The contract spells out what happens when an attack exceeds the plan, and the guaranteed threshold belongs in writing. Sharktech publishes no mitigation threshold, so ask its sales team before signing. X4B states that an attack of extreme intensity can leave a site reachable only from some continents, or lead it to suspend the service, notably when its upstream transit carriers require it.

Check adult content rules with the mitigation provider as well as with the host, since both carry the same traffic. Permission written into the acceptable use policy carries more weight than a reply from support, and a written confirmation obtained when you order keeps a record of what was allowed on that date.