Protection from DDoS attacks

We filter every floating IP for DDoS attacks at no charge. A custom profile keeps one set of settings for several addresses.

A DDoS attack floods a server with traffic until players and visitors cannot reach it. DDoS Shield filters that traffic before it reaches your floating IPs, at no charge.

• 1.4+ Tbps of network capacity
• Under 3 seconds to detect an attack
• 100 million packets a second, the highest limit you can set on an address
• 23 reflection source ports dropped on every address

The filter costs nothing. A custom profile has a price of its own, listed below.

Order a custom profile · Read the guide

Custom profiles

The filter costs nothing. A custom profile shares one set of settings across several floating IPs.

• One set of settings for several addresses (Add-on). A profile holds a protection mode, rate limits, rules and what happens when no rule matches. Every floating IP you bind to it shares them, so a change on one address applies to all of them. Order and use a custom profile
• Rate limits you set (Add-on). Every profile starts with the same limits as any new profile, whichever plan you order, and you change them on the profile. Each limit applies to each bound address on its own.
• Rules aimed at one address (Add-on). Give a rule the address as its destination prefix, and it matches traffic to that address only, though the profile covers several.
• Its own place in the dashboard (Add-on). The Profiles tab lists each profile with its bound addresses, the sources blocked on them and their recent attacks.

Shield Custom Profile prices

The plans differ in price. Each creates the same profile, and you set its limits yourself.

What it stops, and how it filters

Each kind of attack, and the check that drops it. Every floating IP gets all of this, at no charge.

• Amplification and reflection (Included). We drop UDP sent from the 23 source ports that reflection attacks use, such as DNS (53), NTP (123), CLDAP (389), SSDP (1900) and Memcached (11211). A service that listens on one of these ports still gets its players, whose packets come from other ports. Reflection ports
• Fragment floods (Included). We drop IP fragments, and packets whose TCP, UDP or ICMP header is cut short.
• Spoofed and bogon sources (Included). We drop packets from addresses never used on the internet, such as 10.0.0.0/8, and packets with a TTL too low to be real.
• Invalid TCP flags (Included). We drop TCP packets with a combination of flags that no real connection sends, such as SYN with FIN.
• GRE, ESP and other protocols (Included). We drop every protocol other than TCP, UDP and ICMP, and packets that carry IP options.
• Floods above the rate limits (Included). SYN floods, ping floods and UDP floods meet four rate limits on every address, each allowing bursts of up to twice its rate. Rate limits

How DDoS Shield filters traffic

Traffic to an address meets three stages in this order. A packet that one stage drops never reaches the next.

1. Packet checks. We drop the packets attacks use and normal traffic does not: fragments, bogon sources, impossible TCP flags, other protocols and reflection source ports.
2. Rate limits. We drop what one sender, or all senders together, send above the address’s four limits.
3. Rules. Your rules and blocked sources decide what happens to the rest. What passes goes on to your machine.

Protection modes

Each address uses one of three modes, which sets how much of the filtering applies.

What each mode applies

• Packet checks: Standard: Included. Custom: Included. Passthrough: Not included.
• Rate limits: Standard: The platform’s. Custom: The profile’s. Passthrough: Not included.
• Rules and blocked sources: Standard: Included. Custom: Included. Passthrough: Not included.
• Packets that cannot be real: Standard: Included. Custom: Included. Passthrough: Included.

Technical specifications

Every limit here is what the filter does today. You change the rate limits on an address or a profile.

Where and when

• Where it filters: At our points of presence, before traffic reaches your machine
• When it filters: Always. Nothing switches on when an attack starts
• Detection: Under 3 seconds to detect an attack
• Network capacity: 1.4+ Tbps
• What it covers: Every floating IP, IPv4 or IPv6, attached or not, each host of a block, and the IPv6 /64 of an instance

Packet checks

• Dropped: IP options, low TTL, bogon sources, IP fragments, protocols other than TCP, UDP and ICMP, impossible TCP flags, oversized UDP payloads, reflection source ports and truncated headers
• Reflection source ports: 23, always dropped

Rate limits

• Limits on each address: Per source, aggregate, SYN per source and ICMP per source
• Bursts: Up to twice each limit’s rate
• Standard limits: 100,000 packets a second per source, 10 million aggregate, 10,000 SYN and 5,000 ICMP per source
• Limits you can set: Up to 100 million packets a second aggregate and 10 million per source

Rules

• Actions: Allow, drop or limit. The most specific rule that matches decides
• Blocked sources: A drop rule from the source, on any profile

Visibility

• Attack events: Listed on the Events tab
• Emails: When an attack starts and when it ends, within the limits above

What you control

A tag says how each one comes.

Tuning

• Settings for each address (Included). Change how strict the filter is, set your own limits, and add rules that allow, drop or limit traffic, at no charge.
• Block a source (Included). Block an address or a range of addresses that keeps attacking you, at no charge.

Visibility

• Attack events and emails (Included). We email you when an attack starts and when it ends, within the limits below, and the Events tab lists each attack.
• Always on (Included). DDoS Shield filters every floating IP from the moment you order it, attached or not. There is nothing to turn on.

DDoS Shield filters floating IPs, IPv4 and IPv6. The shared address a game server starts with is not filtered.

Attack emails

We tell you when an attack starts and when it ends, and we limit how often.

• The first email (Included). It goes once our scrubbing hosts still report attack traffic to the address a minute after the first report. A shorter burst sends no email and still shows on the Events tab.
• The second email (Included). It goes after 15 minutes with no attack traffic, and says how long the attack lasted. Traffic that returns sooner counts as the same attack.
• The most you get (Included). An address sends emails for at most six attacks in 24 hours. Later attacks show on the Events tab with no email.
• You can turn them off (Included). The emails count as usage alerts, so the Usage alerts switch in your notification settings controls them. Read attack events

What customers use it for

Each one names what it takes and the guide that walks through it.

• Keep a game server online during an attack. Put the game on a floating IP, and players keep playing while the filter drops the flood in front of it. Uses: A game server or Cloud Compute, and a floating IP. Game server protection
• Let a busy service burst. Raise the rate limits for a service with real bursts of traffic, and bind every address it uses to one profile. Uses: A Shield Custom Profile. Order and use a custom profile
• Stop one attacker. Block the address or range that keeps attacking you. The block applies whichever profile the address uses. Uses: DDoS Shield. Block a traffic source
• A website that takes request floods. Put the site behind Edge Proxy, which checks each HTTP request and turns away clients that send too many. Uses: Edge Proxy in front of your server. How web proxies work

Limits

What DDoS Shield does not do.

What it does not do

• What it reads: Packet headers only. A flood of HTTP requests that look real needs Edge Proxy’s web application checks
• Reflection ports: Cannot be opened by a rule. Ask support if a service needs one
• A game server’s shared address: Not filtered. Attach a floating IP to the server
• Traffic you send: Not filtered. DDoS Shield checks what comes in
• Passthrough: An attack reaches your machine in full

Edge Proxy · Floating IPs

Guides for DDoS Shield

Our docs explain what the filter does and how to tune it.

• How DDoS Shield works: What the filter drops, and what it lets through.
• Game server protection: Keep a game server reachable during an attack.
• Order and use a custom profile: Share one set of settings across floating IPs.
• Block a traffic source: Stop an address or a range from reaching you.
• Read attack events: See when each attack started and ended.
• Get help during an attack: What to do when a service stays down.

Protect your server with a custom profile

Order a profile, bind your floating IPs to it, and set the limits your service needs.

Order a custom profile · Order a floating IP