The misconception: DDoS protection is a checkbox. You have it or you don't, and if you have it, you never notice an attack. That's not how it works. Protection is a chain of steps: recognise an attack, separate attack traffic from real traffic, and deliver the clean traffic to your server. How good that chain is decides whether your server stays online.
Here's how that chain works with us, who builds it and what you get to see of it.
Who does it: Levatio, from our sister company Xyphen IT
Our DDoS mitigation runs on Levatio, the in-house mitigation stack of our sister company Xyphen IT. Levatio is active for every service within our group: your dedicated server, your VPS and your game server are all covered. Basic protection comes with your service by default. If you need more, for example because your service is a regular target, we'll work out together what fits.
What happens during an attack
1. Detect. We measure traffic at the edge of our network. A sudden spike is at first only a possible attack: a backup or a large update looks much the same in the first few seconds. Levatio looks at the shape of the traffic and confirms or rejects the attack. Only confirmed attacks lead to a countermeasure and a notification.
2. Classify. Not every attack calls for the same approach. Levatio distinguishes, among others:
- Single target — one server is the target; the countermeasure can be limited to it.
- Carpet bomb — the attack spreads across a whole address block, so no single address receives suspiciously much traffic on its own.
- Packet flood — the problem isn't the amount of data but the number of small packets.
3. Mitigate. Mitigation then starts automatically; nobody has to be woken up first. Levatio puts a rate limit on exactly the attack vectors, for example UDP traffic from port 53, and can have incoming traffic enter over different routes. FlowSpec is one of the mechanisms it uses for that. The goal is to keep your service reachable: blackholing, where all traffic to your address is dropped, is not our default answer. In practice the countermeasure is often in place within seconds, but that's not a guarantee.
4. Wrap up. When the attack dies down, Levatio withdraws its countermeasures and marks the attack as ended.
What you get to see
An attack you can't see is an attack you can't prepare for. That's why the dashboard shows, per attack, what happened: the target, the peak at our edge, how much of it reached you, the vectors and the countermeasure taken.
The overview in the dashboard (Dutch interface), with demo data. The "Bij u aangekomen" (reached you) column matters most: a 48.6 Gbit/s attack of which 124 Mbit/s reached your port is a different story from a small attack that came through in full.
Open an attack and you see the timeline of offered and delivered traffic, the origin by country and network, and exactly which countermeasure became active when.
The detail page of a single attack, with demo data.
This dashboard currently runs at Xyphen IT. We're working on showing it in the PlanetNode client area. If you need it now, we'll onboard you onto the Xyphen IT portal. Xyphen IT walks through following an attack step by step in Following a DDoS attack in the dashboard.
What network protection doesn't solve
To be honest: Levatio protects against attacks that flood your connection or your server with traffic. An application-layer attack, thousands of well-formed requests to the heaviest page of your website, looks like a busy day at network level. Caching, rate limiting in your application and a WAF help there. For which defence fits which type of attack, read DDoS attacks: how to protect your infrastructure by Xyphen IT.
Questions about your setup?
Running a service that's often targeted, such as a popular game server, or want to use the notifications and the dashboard right away? Get in touch and we'll look at what you need together.
Frequently asked questions
Do I need to do anything during an attack?
No. Mitigation starts automatically once an attack is confirmed. If your service is still affected, contact us and we'll look at the same attack straight away.
Will my server be taken offline during an attack?
That's not our default answer. Levatio filters the attack traffic with targeted countermeasures, so legitimate traffic keeps reaching your server.
Does DDoS protection cost extra?
Basic protection comes with every service. If you need more extensive protection, we'll discuss together what fits.