DDoS protection: three attack classes and where each is stopped

The question DDoS defence answers is not the question a firewall answers. A firewall decides which traffic may pass. DDoS defence deals with the case where the traffic looks legitimate but its volume or rate makes keeping the service available impossible.

Three classes, three layers

Attacks fall into three classes and each is met at a different layer. Treating them as one problem with one product is the most common mistake in this area.

Volumetric

Fills the access link. Because a device standing on site cannot drop traffic that never reaches it, this class is met upstream — at the operator, through a clean pipe service, or by diverting to a scrubbing centre. The only number that matters here is your own link capacity: it tells you the threshold above which your own equipment is irrelevant.

State exhaustion

Targets the session table of any device that tracks connection state. The symptom is confusing: bandwidth looks normal, existing sessions keep working, new connections fail. A monitoring system watching link utilisation will not show this attack at all. The counters to watch are session count, table occupancy, half-open ratio and — the distinguishing one — bytes per session, which falls here while it rises in a genuine traffic increase.

Application layer

Made of protocol-valid requests that are expensive to serve. Volume can be small; a few thousand requests per second may stop a service without troubling the link. Separation is possible only through behaviour: which addresses are requested, whether sub-resources are fetched, how regular the intervals are.

Why bandwidth is not a capacity figure

A network device's work is done per packet, and that work barely varies with packet size. Ten gigabits of 1500-byte packets is roughly 800,000 packets per second; the same ten gigabits in 64-byte packets is over fourteen million. Same bytes, seventeen times the work.

An attacker chooses the packet size and has no reason not to choose the smallest. So a device rated at 10 Gbit can be saturated by a 2 Gbit small-packet attack. Nothing was misstated; the unit was simply the wrong one.

For a comparison that means something, three figures are needed together: throughput, packet rate and new connections per second, each with the packet size and configuration it was measured under.

False positives are part of the measurement

Success is usually assessed with one question — did the attack stop. That question is incomplete. If the defence stops the attack while also filtering out a third of real users, the attacker has partly succeeded; only the party causing the outage has changed.

Making this measurable is straightforward: during an acceptance test, run known legitimate traffic alongside the attack traffic and count what fraction arrives.

Where the product fits

In the Labris product family this area is handled by HARPP DDoS Mitigator. Current technical specifications are on the Labris Networks product pages; what that page covers is the problem class and the placement.

Siber Kale publishes in Turkish. This page is a summary for readers who do not read Turkish; the full material — questions, guides and a glossary — is on the Turkish side. The Turkish version of this page is /konu/ddos-korumasi/.