Disclaimer: DDoS mitigation capabilities, pricing, and capacity figures change frequently. This article reflects the landscape as of mid-2026. Verify current specifications with each provider before making decisions.
Distributed denial-of-service attacks have grown in both volume and sophistication. Record-breaking attacks measured in the multiple-terabit-per-second range have been publicly reported by large infrastructure providers in recent years. For anyone running a hosted service, the question is no longer whether you might be targeted, but whether your provider can absorb an attack when it happens. Here is a practical look at what DDoS protection actually involves and how to evaluate it.
The Three Categories of DDoS Attacks
Understanding the attack type matters because different mitigations stop different threats.
Volumetric attacks try to saturate your network link with sheer traffic volume — UDP floods, amplification attacks (DNS, NTP, memcached reflection), and similar. These are measured in bits per second (Gbps/Tbps). The only real defense is having more upstream capacity than the attacker can generate, plus scrubbing.
Protocol attacks target the network and transport layers — SYN floods, fragmented packet attacks, and similar. These are measured in packets per second (pps) and exhaust server or firewall state tables rather than bandwidth.
Application-layer attacks (Layer 7) mimic legitimate traffic — HTTP floods, slowloris, and request-heavy patterns against expensive endpoints. These are measured in requests per second and are the hardest to distinguish from real users.
How Mitigation Actually Works
Effective DDoS protection generally combines several techniques:
- Always-on scrubbing routes all traffic through filtering infrastructure continuously, with low added latency. Good for high-value targets that are attacked often.
- On-demand scrubbing reroutes traffic through scrubbing centers (commonly via BGP announcement) only when an attack is detected. Cheaper, but adds a detection-and-divert delay.
- Anycast distribution spreads incoming traffic across many geographically distributed points of presence, so an attack is diluted across the network rather than hitting one location.
- Rate limiting and behavioral filtering handle Layer 7 attacks by analyzing request patterns, applying challenges, and dropping abusive sources.
What to Ask a Hosting Provider
Marketing pages love to say “DDoS protected” without detail. These questions cut through it:
- What is your total mitigation capacity? A number in Tbps tells you the ceiling of what can be absorbed.
- Is protection always-on or on-demand? And if on-demand, what is the typical time-to-mitigate?
- Which layers are covered? Many basic offerings stop volumetric attacks but leave Layer 7 to you.
- Is there an attack-size cap or null-route policy? Some plans blackhole your IP once an attack exceeds a threshold, which protects the network but takes your service offline.
- Are there extra charges during an attack? Clarify whether mitigation is included or billed by attack volume.
Blackholing: The Hidden Catch
The most important question is what happens when an attack exceeds the provider’s protection tier. On budget plans, the common answer is null-routing: the targeted IP is blackholed upstream, dropping all traffic to it — attack and legitimate alike — until the attack subsides. This protects the provider’s wider network but means your service is effectively down. Always confirm the threshold and the policy.
What You Should Still Do Yourself
No upstream protection removes the need for application hygiene. Keep software patched, put a caching layer or reverse proxy in front of dynamic content, set sensible rate limits on expensive endpoints and login forms, and avoid exposing services (like open DNS resolvers) that can be abused for amplification. A well-architected application is far cheaper to defend.
How Noded Approaches It
Our network is built with DDoS mitigation integrated at the edge rather than bolted on. Volumetric and protocol-layer attacks are filtered upstream before they reach your server, and we are transparent about thresholds and policies rather than hiding them behind “unlimited protection” claims. If you are evaluating where to host a service that needs to stay online under pressure, talk to us about your specific traffic profile and threat model.
FAQ
Does a CDN protect against DDoS?
A CDN with anycast and scrubbing absorbs many volumetric and Layer 7 attacks against cached content well. But it protects your origin only if the origin IP is hidden and locked down; if attackers find your origin directly, the CDN is bypassed.
How big do DDoS attacks get?
Publicly reported peaks have reached into the multiple-terabit-per-second range. Most attacks against typical hosted services are far smaller, but the tail is what catches unprepared providers.
Is free DDoS protection enough?
Free tiers from large providers stop a meaningful share of common attacks. Whether it is enough depends on how often you are targeted and how costly downtime is for you. High-value targets usually need always-on, higher-capacity mitigation.
What is the difference between Gbps and pps in attacks?
Gbps measures bandwidth saturation (volumetric attacks); pps measures packet rate (protocol attacks that exhaust processing or state tables). A small-bandwidth, high-pps attack can still take down hardware that has plenty of spare bandwidth.