.png)
A Distributed Denial of Service (DDoS) attack overwhelms your infrastructure with junk traffic. The only reliable defense is a network with vastly more capacity than any attacker — and the intelligence to filter the bad from the good.
Types of DDoS attack
| Layer | Example | Defense |
|---|---|---|
| Volumetric (L3/4) | UDP/ICMP floods that saturate your bandwidth | Anycast absorption across global capacity |
| Protocol (L3/4) | SYN floods that exhaust connection tables | SYN proxy and rate limiting at the edge |
| Application (L7) | HTTP floods that look like real users | WAF + bot management + behavioral analysis |
How edge scrubbing works
Your network prefix (or app) is fronted by a global Anycast edge. Attack traffic is absorbed across hundreds of locations rather than hitting one link, filtered ("scrubbed"), and only clean traffic is forwarded to you.
- Always-on — no manual "redirect during attack" delay.
- BGP-based — protects entire network ranges, not just websites.
- Anycast capacity — attacks are diluted globally.
- Automatic — mitigation triggers in seconds.
Two deployment styles: a reverse-proxy model protects web apps (HTTP/S) — see our WAF & reverse proxy guide. A BGP/network model protects entire IP ranges and non-web services (VoIP, VPN, gaming) with traffic acceleration on top. See our Anycast guide for the underlying architecture.
Contact our engineers to discuss DDoS protection architecture for your network or applications.