Volumetric Protection

We have deployed rules at the core switches of our Upstream provider (Datacamp). That allows us to drop large scale volumetric attacks, like amplification & reflection, before reaching our own scrubbing nodes.

Additionally, all of our subnets are protected by their own proprietary anti-DDoS solution to handle more sophisticated Layer 3/4 attacks.

These rules alone can drop attacks of up to 130 Tbit/s on the edge.

• UDP floods of any kind
• TCP SYN ACK Reflection Floods
• ICMP Echo Request Floods
• IP Packet Fragment Attacks
• IGMP Floods
• TCP SYN Floods
• TCP Spoofed SYN Floods
• TCP ACK Floods
• TCP Fragmented Attacks

Layer 7 Protection

Our Layer 7 Protection is always active and works in-line with zero TTM (time to mitigate). All scrubbing nodes are connected with redundant high-bandwidth ports (n x 40G).

Every incoming packet is checked to make sure that it follows a specific application protocol, like the Minecraft Protocol. These checks guarantee that only legitimate packets will be forwarded to your server and any bad or invalid packet will be blocked at our edge.

Furthermore, we provide detailed logging and reporting capabilities, allowing you to monitor your server's traffic and detect any unusual activity. This information helps you to take appropriate action and further enhance your server's security posture.

All of our nodes are equipped with eBPF XDP filters to drop large attacks with even millions of packets per second.

TAKE A LOOK AT WHAT OUR MITIGATION PIPELINE CONSISTS OF

Volumetric Protection

With a TTM of just a few seconds, our upstream infrastructure effectively blocks high bandwidth/pps attacks, e.g. fragmented packets or AMP attacks.

• ACLs on our upstreams
• Applied on all core routers of our upstreams (all PoPs), we use our own rules to reliably block AMP and Reflection based attacks.
• Our proprietary XDP filter
• Applied on the edge of our anycast nodes, our protocol-based checks filter almost any L4/L7 attack reaching us. Dynamic rules and settings can be created through our API or Panel.
• Applications or your network
• Only very small attacks will get to this stage. Here, our proxies mitigate more complex layer 7 attacks (e.g., bot attacks). Only legitimate traffic that passes through our proxy will be forwarded.

HammerVM LTD utilizes NeoProtect for our DDoS Mitigation.