DDoS protection is not a product you buy. It is a stack of layers, each stopping a different attack family, plus the discipline to test the stack before an attacker does. With attacks above one terabit per second appearing 935 times in the first half of 2026, the question is no longer whether your defenses will be tested, but when.
Government guidance is unambiguous on the shape of a good defense. The joint CISA, FBI and MS-ISAC guide and the UK NCSC’s DoS guidance collection both recommend layered mitigation combined with rehearsed incident response. This guide turns that guidance into a concrete architecture.
The Four Layers That Actually Stop Floods
Each attack family targets a different resource, so each defense layer covers a different failure mode. Skip one and you leave a door open.
- Anycast distributionAnnouncing your service from many global points of presence spreads a volumetric flood across the provider backbone instead of your single uplink. This is the layer that makes terabit-class attacks survivable.
- Upstream scrubbingYour ISP or a cloud scrubbing service filters attack traffic before it reaches your connection. Once a flood exceeds your link capacity, only upstream help matters. Services like AWS Shield, Google Cloud Armor, and Azure DDoS Protection operate at this layer.
- Rate limiting and connection capsProtocol attacks like SYN floods exhaust state tables, not bandwidth. Per-source rate limits, SYN cookies, and aggressive timeouts protect firewalls and load balancers from drowning in half-open connections.
- Web application firewallLayer 7 floods look like real HTTP traffic until you inspect patterns. A WAF with bot detection and request-rate rules filters malicious requests before they consume web workers and CPU.
Match the Defense to the Attack
The fastest way to waste a security budget is defending against the wrong family. Use the attack taxonomy from our DDoS explainer and map each one to its layer.
| Attack family | Example vectors | Resource exhausted | Defense layer |
|---|---|---|---|
| Volumetric | UDP flood, DNS and CLDAP amplification | Link bandwidth | Anycast and upstream scrubbing |
| Protocol | SYN flood, ACK flood, fragmentation | Firewall state tables | Rate limiting, SYN cookies |
| Application | HTTP flood, Slowloris, Rapid Reset | Web workers and CPU | WAF, bot rules, request caps |
The 2026 telemetry shows DNS-based reflection leading the network layer at 34.3 percent of attacks, which is why upstream filtering matters more than ever.
A Response Runbook You Can Rehearse
Technology absorbs the flood; process ends the incident. CISA’s Understanding Denial-of-Service Attacks guidance starts with the same basics every runbook needs.
- Detect: baseline normal traffic so anomalies are obvious, and alert on latency, error rate, and bandwidth deviation, not just hard downtime.
- Confirm: rule out maintenance and internal causes with your network administrator before declaring an attack.
- Engage upstream: contact your ISP or scrubbing provider early. Their filters work only while your link still carries clean traffic.
- Filter: apply rate limits and WAF rules for the specific vector instead of broad blocks that punish real users.
- Communicate: status page updates during an attack reduce support load and protect trust while mitigation runs.
- Review: after the event, record the vector, the threshold where defenses engaged, and the gaps to fix.
The ten-minute reality: 90.6 percent of network-layer attacks in H1 2026 ended within ten minutes. Attackers abandon targets that hold. A defense that survives the first ten minutes wins the overwhelming majority of encounters.
Validate the Stack With Authorized Testing
A mitigation you have never tested is a hypothesis. Authorized stress testing against your own infrastructure confirms that each layer engages at the threshold you expect, before a real attacker runs the experiment for you.
Our step by step legal guide walks through the compliant process: written authorization, provider notification, a scoped rate limit, and a defined stop condition. For game infrastructure, the game server testing guide adapts the same methodology to UDP-heavy workloads. And if you are evaluating tools, the main IP stresser guide and free tools ranking cover legitimate options that verify ownership before generating a single packet.