DDoS protection explained
Answer
DDoS protection filters attack traffic before it reaches your server. Layer 3 and 4 scrubbing absorbs volumetric floods and is included on every Incognito VPS plan with 11 Tbps of capacity. Layer 7 attacks target the application and need request-level filtering, available as a $12 per month add-on.
Two different problems with one name
A volumetric attack tries to fill your pipe: UDP floods, amplification through open reflectors, SYN floods. The traffic is obviously malformed or obviously excessive, and filtering it is a capacity problem — you need more absorption than the attacker has generation.
A layer-7 attack sends requests that look legitimate, individually, and simply sends far too many. Each one is a valid HTTP request that your application must actually process. No amount of bandwidth capacity helps, because the traffic is not the problem — the work it causes is.
What a Tbps figure actually tells you
Our 11 Tbps is scrubbing-network capacity: the total volume the filtering infrastructure can ingest and process. It is a real number and it is also the number every provider quotes because it is the most flattering one available.
What matters more in practice is time to mitigation and false-positive rate. An attack detected in ninety seconds has already caused an outage. A filter that drops 5% of legitimate traffic has caused a different outage. Our detection triggers within about eight seconds of an anomaly and mitigation engages automatically, which is the number worth asking any provider for.
- Scrubbing capacity
- 11 Tbps
- Detection to mitigation
- ~8 seconds
- Included on
- every plan, always on
- Layer 7 filtering
- $12/mo add-on
- Null-route policy
- never — we filter, not blackhole
The null-route question you should ask every host
When a cheap provider is attacked, the common response is to null-route the target address — dropping all traffic to it, attack and legitimate alike, until the attack stops. This protects the provider’s network and takes your service completely offline, which from your side is indistinguishable from the attack succeeding.
We do not null-route customer addresses. We filter. It is more expensive to operate and it is the actual product. If you are comparing hosts, ask directly what happens when you are attacked, and ask for the null-route policy specifically.
When you need the layer-7 add-on
If you run a public web application that anyone can send requests to, and especially one with expensive endpoints — search, dynamic report generation, anything hitting a database hard. Also if you have been attacked before, because targets rarely get attacked only once.
If you run a private service reachable only over WireGuard, or a VPN endpoint, or a Tor relay, the default L3/L4 protection is genuinely sufficient and the add-on would be waste.
Frequently asked questions
01 Is DDoS protection included?
Yes, always-on L3/L4 scrubbing with 11 Tbps of capacity on every plan at no extra cost. Layer-7 request filtering is a $12/month add-on.
02 Do you null-route servers under attack?
No. We filter rather than blackhole. Null-routing protects the provider and takes your service fully offline — from your side, indistinguishable from the attack succeeding.
03 Do I need layer-7 protection?
If you run a public web application with expensive endpoints, or you have been attacked before, yes. For a VPN endpoint, Tor relay or private service behind WireGuard, the default is genuinely enough.
Related