1. The Anatomy of Modern DDoS: Why On-Premises Appliances Fail Alone
Many IT teams assume that perimeter Next-Generation Firewalls provide sufficient DDoS protection. However, hardware firewalls alone cannot withstand upstream volumetric floods. While edge firewalls excel at stateful inspection and application policy enforcement, they cannot mitigate modern volumetric attacks on their own.
Volumetric DDoS attacks often flood targets with 100Gbps to 500Gbps of UDP amplification traffic. Under this volume, even a dedicated 1Gbps or 10Gbps business leased line) saturates upstream at the Tier-1 carrier handoff. No stateful firewall rule can process packets that never reach its ingress interface.
Volumetric (L3/L4)
UDP reflection (NTP, DNS, CLDAP), ICMP floods, and SYN floods designed to overwhelm physical circuit bearer capacity upstream.
State-Exhaustion
TCP SYN-ACK floods and connection table exhausters designed to fill state tables on firewalls, load balancers, and VPN gateways.
Application Layer (L7)
HTTP/2 Rapid Reset, slowloris, and heavy database API query exhaustion masquerading as legitimate user session transactions.
2. DDoS Mitigation Architectures: How Providers Compare
When evaluating DDoS mitigation providers (such as Nomios, Cloudflare Magic Transit, Akamai, or ManagedByUs Clean Pipes), packet architecture is critical. The underlying forwarding mechanism dictates routing latency, operational cost, and failover performance.
| Architecture Topology | Redirection Mechanism | Latency Overhead | Clean Traffic Return Path |
|---|---|---|---|
| Always-On BGP Anycast | Global Anycast prefix broadcast (/24 IPv4) | Near-Zero (<3ms local PoP) | Direct Cross-Connect / MPLS / GRE |
| On-Demand BGP Swing | Manual or API BGP route withdrawal | Variable (5–15 min convergence) | Encapsulated GRE / IPsec Tunnels |
| Carrier-Integrated Clean Pipes | Upstream Tier-1 BGP Community & Flowspec | Zero Latency Added | Native Leased Line Bearer |
| DNS Proxy (Reverse Proxy) | CNAME redirection / Anycast DNS | Moderate (Web only: HTTP/S) | Origin IP Hidden behind SNI Reverse Proxy |
3. The Mechanics of BGP Anycast Scrubbing
(To understand underlying autonomous system peering and prefix propagation, review our companion engineering guide to BGP Routing Demystified.) Traditional unicast routing routes an enterprise’s public IP subnet to a single physical location. If that gateway experiences an attack exceeding its link capacity, packet drop occurs across all transit providers.
With BGP Anycast, the same IP prefix (/24 or larger) is announced simultaneously from multiple geographically dispersed Points of Presence (PoPs) worldwide. When a botnet generates distributed attack traffic, Border Gateway Protocol automatically directs the traffic to the nearest topological scrubbing centre:
How Scrubbing Centres Filter Malicious Payloads:
- Traffic Ingestion: Ingress routers receive multi-hundred-gigabit streams distributed across regional nodes (London, Amsterdam, Frankfurt, New York).
- Hardware Decoupling: FPGA and ASIC scrubbing arrays strip malformed Layer 3/4 headers, drop unrequested UDP responses, and authenticate TCP handshakes via SYN cookies without burdening downstream firewalls.
- Clean Traffic Injection: Legitimate, sanitized customer packets are returned to the enterprise edge router over a direct physical interconnect, dedicated cloud direct connect, or private Layer-2 Ethernet Private Line (EPL).
4. Granular Filtering via BGP Flowspec (RFC 5575)
Historically, when an enterprise faced an overwhelming volumetric attack targeting a specific internal IP, tier-1 transit providers used Remotely Triggered Blackhole (RTBH) routing. RTBH announces the victim IP to a blackhole null0 route. This discards attack traffic and legitimate requests alike, completing the denial of service.
ManagedByUs incorporates BGP Flowspec (RFC 5575). Instead of null-routing entire destination IP addresses, Flowspec propagates fine-grained firewall filtering rules into the upstream carrier routing fabric within seconds:
// Example Flowspec policy matching NTP reflection attack
flowspec-rule DROP-NTP-REFLECTION {
match {
protocol udp;
source-port 123;
packet-length >= 468;
}
then drop;
}
By filtering strictly matching attack vectors at upstream transit nodes, legitimate enterprise application traffic continues to traverse the circuit unimpeded.
5. The GRE Tunnel MTU Trap in DDoS Scrubbing
Many cloud scrubbing vendors return clean traffic via generic GRE (Generic Routing Encapsulation) tunnels over the public Internet. Network engineers must account for the 24-byte overhead that standard GRE adds to each packet header:
Preventing Frame Fragmentation & Throughput Degradation:
Standard Ethernet MTU is 1,500 bytes. Encapsulation reduces effective Maximum Transmission Unit (MTU). A 20-byte IPv4 header and 4-byte GRE header yield 1,476 bytes, or 1,436 bytes with IPsec.
Packets with the Don’t Fragment (DF) bit set can stall if Path MTU Discovery (PMTUD) fails. This occurs when upstream network firewalls block ICMP Type 3 Code 4 messages. Edge firewalls must enforce TCP MSS Clamping to 1,436 bytes across all scrubbing tunnel interfaces to ensure seamless transport.
Size Your WAN Ingress & Edge Security
You can deploy inline Next-Generation Firewalls using Firewall as a Service (FWaaS) or integrate upstream BGP Anycast clean pipe scrubbing. In both deployment models, accurate bandwidth planning ensures your ingress pipes stay clean under load.