Which resource is being targeted?
A DDoS attack attempts to exhaust a service with traffic or requests from distributed sources. It may target network bandwidth, connection tables or an expensive application operation. A single traffic volume therefore cannot describe every attack. Examine packets and requests per second, connection behaviour and application error rates together.
Where does filtering happen?
Network filtering aims to remove malicious packets, while application controls assess request behaviour. If traffic saturates your connection, a firewall on the server alone may not suffice; upstream mitigation may be needed. CDNs, WAFs and rate limiting address different problems and must suit the protocol and application.
Verify the protection scope
A protection service may not cover every protocol or attack type. Ask your provider about protected IPs and protocols, activation methods, traffic limits and handling of false positives. This article promises no ROVE capacity, response time or uninterrupted availability; verify the applicable scope in the service documentation.
What to record during an incident
Knowing your normal traffic profile helps you make better decisions during an attack. Record changes and preserve management access before broadly blocking traffic. Remove access tokens and personal data from logs you share.
- Start time, timezone and affected service.
- Traffic measurements and error samples.
- Changes made and observed results.
Images are illustrative; they do not represent ROVE facilities or hardware inventory.
Back to blog
