DDoS filtering: L3/L4 vs L7

Where included scrubbing stops and your application begins: volumetric drops at the edge, HTTP-layer floods on your stack, BYOIP on the top metal tiers.

Повний текст статті англійською. Шапка, каталог і оплата перекладені.

Always on

L3/L4 scrubbing runs on every VPS and dedicated SKU with no second invoice attached — the edge absorbs floods on the order of a 1 Tbps-class capacity before they touch your plan's port. Because filtering is a platform property rather than a per-IP product, an attacker cannot buy your way out of protection or aim at an unprotected address you own.

L7 is different

Application-layer floods disguise themselves as ordinary HTTP and pass right through a stateless edge — draining connection pools and databases is your stack's war. Optional L7 assistance exists for HTTP workloads, with a hard limit: it is a mitigation service, never cover for AUP violations; the policy travels with the traffic it shields.

IP and BYOIP

Every VPS ships 1x IPv4 plus a /64 with editable PTR. Bringing your own ranges is a dedicated-tier feature — Fortress and Citadel — arranged with a LOA and ASN and a few days of lead time, after which your announcements originate from the same filtered edge. Published looking-glass endpoints give indicative RTT per flag before you order.