DDoS protection

A distributed overload attack: many systems simultaneously generate a flood of data aimed at one target until its infrastructure can no longer carry the load and the application can no longer be reached. The effort for the attacker is small; the damage for the target can be large.

Both, for different cases. If we run the system, the protection is part of it: Secure Public Cloud, private cloud, cloud servers and managed services include it at no extra charge. In colocation, your own machines stand in our data centre — there the defence is a service you book in addition, and that is why it has a price here. The technology behind it is the same.

The attack traffic is redirected to external scrubbing centres. There, malicious traffic is filtered out and kept away from the target, while the productive traffic continues to be delivered. The methods used include bogon filtering, IP reputation filtering, protocol verification, stateful TCP connection filtering, IP rate limiting and statistical application protocol filtering.

Incident-based protection becomes active when an attack is detected. With "always on" protection, traffic runs through the filtering all the time. Incident-based costs less; "always on" reacts without any switchover time. Which fits depends on how sensitive your application is to the switchover.

With managed systems, nothing extra — the protection is included there. In colocation it is a service of its own: incident-based defence costs €399.00 net per month per IP range, with 100 Gbit/s protection bandwidth, plus €199.00 net one-off for setup. For continuous "always on" protection and web DDoS protection, we price according to protection needs.

Yes. Web DDoS protection detects and fends off attacks on TLS-encrypted (HTTPS) traffic as well. Pure volume filtering does not see these attacks.

Cleaning can be limited to the EU. For systems with requirements on where data is processed, that is the deciding detail — tell us whether it applies to you and we will set it up that way.

No. DDoS defence keeps overload away from the target, but it does not check what individual permitted connections do. That is the job of the firewall, the web application firewall and attack detection. The layers complement one another.

We monitor around the clock, every day of the year. How quickly we intervene and through which escalation stages is set out in your contract — a time we have not committed to is not a time we state here.