DDoS Protection
Core concepts
DDoS defense spans volumetric (bandwidth/packet floods), protocol/state-exhaustion (SYN floods, reflection/amplification), and application-layer (HTTP floods, slowloris) attacks. Know the mitigation stack: anycast scrubbing at the edge absorbs and cleans volumetric traffic; rate limiting and connection controls handle floods; behavioral/application profiling catches L7 attacks that look like normal requests.
Understand reflection and amplification (attacker spoofs victim source, sends to open resolvers/servers that reply with larger responses) and why source validation and rate limiting on DNS/NTP matter. Learn always-on vs. on-demand mitigation and the role of health checks and origin protection so scrubbed traffic reaches a healthy origin. Distinguish network-layer from application-layer signals - a volumetric attack may never reach your WAF, while an HTTP flood may pass network filters and need app-layer rules.
Traps to watch
- Assuming the WAF sees volumetric attacks - it may be bypassed entirely at L3/L4.
- Confusing rate limiting (per-client request caps) with volumetric scrubbing (bandwidth absorption).
- Forgetting that slow, low-and-slow attacks evade simple rate thresholds; behavioral detection is needed.
- Overlooking origin exposure - if the origin IP is discoverable, attackers can bypass the edge.
Rule of thumb
Match the defense to the layer: volumetric → anycast scrubbing; protocol → connection/state controls; application → rate limits and behavioral rules. Keep origins hidden and healthy.
Worked example: A SYN flood saturates links. Anycast edge absorbs and scrubs it before origin; simultaneously a slow HTTP flood targets the login page, so an application-layer rate control on that path is added.