What Is DDoS Protection and How Does It Work?

A DDoS (distributed denial of service) attack tries to knock a service offline by flooding it with more traffic than it can handle. Here is how these attacks work, what DDoS protection does and what it cannot do.

The three kinds of attack

• Volumetric attacks fill the network pipe itself with junk, measured in gigabits per second. Examples are UDP floods and DNS or NTP amplification.
• Protocol attacks abuse how connections work, such as SYN floods that exhaust the server's connection table.
• Application-layer attacks send many legitimate-looking requests, such as thousands of searches or logins per second, to exhaust CPU and databases.

In network terms, the first two are layer 3 and 4 (L3/L4) attacks and the last is layer 7 (L7).

How network-level protection works

1. Traffic to your IP address passes through the provider's filtering hardware first.
2. The system learns what normal traffic looks like and flags anomalies.
3. Malicious packets, such as spoofed sources or malformed packets, are dropped before they reach your server.
4. Clean traffic continues on as normal, usually with no visible delay.

Every VPS on our platform includes L3/L4 protection, which covers the volumetric and protocol attacks that cause most outages.

What L3/L4 protection does not stop

Layer 7 floods look like real visitors, so network filters cannot always tell them apart. You handle those at the application level:

• Put a CDN or reverse proxy in front of web sites and cache aggressively.
• Use rate limiting in Nginx (limit_req_zone) for login and search pages.
• Use fail2ban to block repeat offenders.
• Serve static pages where you can; they cost almost nothing to deliver.

Reduce your exposure

• Keep your origin IP private if you use a CDN, and do not leak it in DNS history or email headers.
• Close every port you do not use.
• Keep software updated so that attackers cannot use a small bug to crash it.
• Monitor resource use so that you notice trouble early.

What to do during an attack

1. Confirm it is an attack: check bandwidth graphs and ss -s for connection counts.
2. Contact your host's support so that they can adjust filtering.
3. Enable rate limits or put the site behind a proxy.
4. Do not pay extortion demands. Payment does not stop repeat attacks.