DDoS Mitigation
Full-stack DDoS mitigation, engineered without compromise
Heuristic filtering in the hardware datapath at every Wirescope point of presence (PoP), from volumetric floods to application-layer attacks. No diversion, no nullroutes, no attack traffic on your bill. Read about how we designed Wirescope for DDoS.
Predictable Under Attack
Attacks are violent. Your bill should not be.
You buy the port; everything we filter inside it is free. Attack traffic is dropped at our edge, excluded from billing, and never counts toward your commit or your 95th percentile, at any size. There is no attack tier to pick, no clean-traffic allowance, and no fallback mode to trigger. Your invoice is your commit.
- Transit with managed, partial, custom or no mitigation
- How transit is billed
- Standalone mitigation over a tunnel
- Inline at the PoP
- Attacks are dropped where they enter our network, never backhauled to a distant scrubbing center and tromboned back.
- Stateless by design
- Filtering works without return-traffic visibility, so asymmetric routing and partial announcements are fine.
- No nullroutes
- We filter the attack and keep you announced. Your prefixes never leave the routing table to save someone else's network.
- Transit on the same path
- Mitigation is part of your connectivity, not an overlay on someone else's. One hop, one SLA, one bill.
How It Works
Five stages, one pass
Every packet crosses the full pipeline before it reaches you. Malicious traffic is dropped at the earliest stage that can identify it; clean traffic never leaves the forwarding path.
Ingress & classification
Traffic for your prefixes lands at a Wirescope PoP and is classified on arrival using flow telemetry, protocol fingerprinting, and behavioral signatures.
Every packet inspected, no sampling
Volumetric scrubbing
Amplification floods (NTP, DNS, CLDAP, Memcached, SSDP, CHARGEN) are dropped at the PoP where they enter, before they touch the delivery path.
Dropped at the ingress PoP
Protocol-level filtering
TCP state tracking, SYN cookie validation, and anomaly detection neutralize SYN, ACK, and RST floods and malformed packet storms.
Drop-or-pass at wire speed, per packet
Application-layer analysis
Deep packet inspection identifies HTTP floods, slowloris, DNS query floods, and encrypted vectors, separating real traffic surges from coordinated attacks.
Anomaly scoring tuned to your traffic profile
Clean traffic delivery
Clean traffic is forwarded by your preferred method, with full visibility into what was filtered, why, and how much.
Same path and speed as before the attack
Architecture
Two tiers of mitigation, built for the worst case
Nearly every attack is absorbed in our own forwarding path, with the full depth of the filtering stack. For the rare flood that outgrows a single ingress, a hyperscale volumetric layer takes the overflow.
Tier 1
In-house, at every PoP
Purpose-built ASICs in the forwarding path
Filtering runs on our own hardware, in the same datapath that delivers your traffic. Packets are classified and scored as they cross the chip: nothing is copied into memory, queued for a verdict, or replayed in software. Behaviour during an attack is the behaviour you measured before it.
- No queueing. Packets are scored in flight; inspection adds no dwell time.
- No emulation. The filtering logic is the datapath itself.
- No fallback mode. There is no slow path to drop into under load.
Tier 2
Beyond our own edge
A hyperscale volumetric backstop
For the rare event where absorbing an entire flood at our own edge stops making operational sense, Cloudflare provides an additional volumetric layer. It is a layer on top, not part of the capacity we describe as in-house, and we never count it as ours.
- Stops at our edge. The relationship is ours; it changes nothing about how you route.
- Nothing to sign. No per-prefix fees and no forced DNS change.
- BGP is yours. No restrictions on what you announce or how.
What that has to survive
The chart starts on ordinary traffic and zooms out when an attack lands. The line your bill follows is the one that never moves.
Arriving at our edge · illustrativeNormal traffic
14Gbps
1× your normal traffic
Chart zoomed out
1×
Billing ledger · illustrative
- Your traffic
- 95th percentile, the clean series
- 14.0 Gbps
- billable
- Discarded traffic
- attack traffic filtered at our edge, never forwarded to your port
- 0 GBpeak 0.0 Gbps above your line
- not billed
- Billed for
- unchanged by the attack
- 14.0 Gbps
- total
Illustrative traffic, not a capacity figure or a delivery guarantee. 6 Tbps is the largest attack we have blocked, a record rather than a guarantee, with a bounded volumetric backstop beyond our own edge.
Heuristics
Tuned to the traffic you actually run
Static rules catch known attacks. The heuristic engine handles the rest: it scores traffic against behavioral signatures, protocol anomalies, and the profile of your service, so a flood that has never been named still gets dropped.
- Behavioral fingerprinting
- Flows are fingerprinted on packet timing, TTL distribution, window sizes, and payload entropy, separating real users from botnet nodes even as attackers rotate IPs.
- Profile-aware thresholds
- Sensitivity is set per prefix, protocol, and flow from your service profile, so expected spikes are provisioned for, not flagged.
- Event-driven rules
- When an attack is confirmed, scoped rules deploy to every PoP at once and take effect in the datapath within seconds, with no reconvergence and no traffic diversion.
- Protocol anomaly scoring
- Every packet gets a composite anomaly score from header compliance, behavioral deviation, and statistical outliers, then passes, drops, or gets challenged.
Protocol-aware defense
Dedicated validation logic per workload instead of generic packet rules. Don't see your protocol? We can build custom filtering for it, or you can write your own rules in BPF syntax, the same filter syntax as tcpdump.
Web & API
HTTP/S- HTTP/2 rapid reset defense
- Slowloris & slow-read detection
- API rate limiting per endpoint
DNS
DNS- Query flood filtering
- NXDOMAIN attack detection
- Amplification reflection defense
Game servers
UDP/TCP- Per-player session tracking
- Game protocol validation
- Player-count-aware scaling
Custom protocols
ANY- BPF-syntax custom rules
- Payload pattern matching
- Zero-downtime rule deployment
Attack coverage
The full mitigation stack ships with every deployment. No tiers, no add-ons. Filter by name or layer to see how each vector is identified and where it is dropped.
L3Network
10Floods and reflection; most of it absorbed on capacity, the rest scrubbed in-house
Dropped at our edge
Absorbed on the volumetric backstop
L4Transport
5State and handshake abuse, tracked per flow
Dropped at our edge
L7Application
6Request-level abuse, judged against a baseline
Dropped at our edge
Pick a vector to see how it is identified and where it is dropped.
The list is what we can name, not the limit of what is dropped: anything that behaves like an attack is scored and filtered whether or not it has a name yet.
Integration
Connect your way
Choose the onboarding method that fits your infrastructure. All methods deliver the same full mitigation stack with identical SLAs.
Inline transit
Option on any transit port
Mitigation switched on at your IP transit port. One path, one contract, nothing to divert.
- Enable on any transit port: managed, partial or custom
- Same port, same path, no overlay
- Full BGP table on the same session
- Single or redundant ports
Tunnel
Fastest setup
The fastest way to get protected, and the easiest to change later.
- GRE / IPsec / IPIP / QUIC
- Emergency onboarding in hours
- Switch delivery method anytime
- Multi-tunnel load balancing
Cross-connect / fibre
Lowest latency
Physical interconnect at any of our PoPs. Lowest latency, highest throughput.
- 10GE / 25GE / 100GE ports at every PoP
- 400GE in Ashburn (Equinix DC2)
- Campus cross-connects where the fabric reaches
- Single or redundant ports
On-premise appliance
On-premise
Our hardware inside your network, running the same engine as our PoPs.
- Deployed at your network edge
- Same filtering engine as our PoPs
- Local inspection: data never leaves your network
- Managed and updated remotely by Wirescope NOC
Proxy
Per application, no ASN needed
A protected address in front of one service. Traffic terminates at our edge, is validated for the application behind it, and is forwarded to your origin.
- TCP and UDP forwarding, per port
- Protocol-aware validation for the service behind it: web, DNS, game servers, custom
- Origin stays private; only the protected address is public
- No BGP, no prefixes, no tunnel
Every mitigation control (rules, thresholds, prefixes, alerting) is yours to tune in real time: from the panel, through the API, or over FlowSpec, a BGP extension for pushing filtering rules from one network into another. No tiers, no paywalled knobs.
SLA
Backed by real commitments
Uptime, time-to-mitigate and false-positive commitments are contractual and set out in the service level addendum to your agreement. We publish the figures when we can stand behind them.
- Network uptimeNot yet published
- Measured per calendar month across all PoPs
- Time to mitigateNot yet published
- Covers volumetric and application-layer attacks alike
- False positive rateNot yet published
- With managed filters tuned to your traffic profile
- Clean traffic deliveryNot yet published
- Legitimate traffic keeps flowing during active mitigation
- BGP convergenceNot yet published
- Full route propagation across the network
- NOC responseNot yet published
- 24/7 response to customer-initiated escalations
Under attack right now?
Our NOC team is available 24/7 for emergency DDoS mitigation. Tunnel onboarding over GRE, IPsec, IPIP, or QUIC in hours, not days.
FAQ
Common questions
Ready to stop DDoS attacks?
Tell us about your network and your threat model. Tunnel onboarding runs in hours; a new cross-connect takes five to ten business days.