On this page
Key points
- Beyond the 1Tbps headlineCredible mitigation also depends on PPS, routing, clean handoff, upstream relief and stability during an attack.
- What to verifyUpstream capacity, delivery method, BGP/FlowSpec rules, latency, MTU, monitoring and fallback scenarios.
- Production integrationThe protection path must fit your architecture: BGP, GRE/IPIP/VXLAN, cross-connect or router VM.
1Tbps alone does not define good protection
Saying that a provider has 1Tbps DDoS mitigation does not answer the operational questions that matter. The number may represent theoretical, global or shared capacity, but not necessarily what is available for one customer, where absorption happens, which attack families are covered, or how clean traffic is returned. A 1Tbps event can overload a link, a port, a firewall state table, a CPU queue or an upstream long before the marketing number is reached.
The real problem is architectural. Traffic must be attracted to a layer that can absorb it, filtered as early as possible, then delivered back through a handoff model compatible with production. For BGP customers this means controlled announcements, route preference and sometimes FlowSpec. For customers without an ASN, protected IPs, tunnels or reverse proxies may be better. In every case, the network design must be understandable.
- Raw capacity
- Useful for volumetric absorption, but not enough without handoff quality, PPS limits and false-positive control.
- PPS and state
- A lower-Gbps attack can still break a service through packets per second, SYN pressure or firewall state exhaustion.
- Clean return
- Legitimate traffic must return to the server, router or datacenter without avoidable loss or unsafe asymmetry.
Why it matters for businesses that depend on Internet exposure
When a company depends on public Internet reachability, a few minutes of downtime can cost more than a month of protection. A hoster loses customer trust, a gaming platform loses players, a SaaS platform blocks users, and a critical service looks fragile. At 1Tbps, the incident can affect upstreams, ports, edge devices and sometimes several services at once.
Plan attraction, reduction, filtering and clean delivery before an incident. Record the prefixes you may announce, authorization, the failure signal, the person allowed to change policy and the recovery conditions. Test the actual destination and return path: a dashboard showing an established tunnel does not prove that a user can reach the application.
Possible ways to absorb and filter a 1Tbps DDoS attack
The first model is protected IP transit with BGP. The customer announces prefixes, the Anti-DDoS provider attracts traffic, filters the attack and hands clean traffic back. This is the natural option for operators, hosting providers, networks with their own ASN or companies that want to keep routing control. You should check route policy, BGP communities, AS-SET support, filters and the capacity that can actually be activated.
The second model is tunnel delivery with GRE, IPIP or VXLAN. It fits cases where the server or network stays with another provider but traffic must pass through a specialised mitigation layer. The third model is datacenter cross-connect, often cleaner for high volume and latency-sensitive designs. Finally, gaming or application reverse proxies are useful for FiveM, Minecraft, HTTP and some exposed protocols, but they do not always replace upstream L3/L4 filtering.
| Model | Best use case | Check carefully |
|---|---|---|
| BGP / protected transit | Prefixes, ASN, operators, hosting providers, multi-service infrastructure | Communities, activation time, announcement policy, capacity per port |
| GRE / IPIP / VXLAN | Keep a server at another hoster, progressive integration, quick deployment | MTU, return routing, latency, tunnel monitoring |
| Cross-connect | High volume, datacenter presence, stable handoff needs | Port, VLAN, DC timeline, redundancy, physical capacity |
| Reverse proxy | Gaming, HTTP, API or protocol-aware protection | Protocol compatibility, latency, logs, false positives |
Worked example: what reaches a 10 Gbit/s handoff?
Hypothetical capacity exercise, not a measured Peeryx attack or filtering promise: an attack contributes 1,000 Gbit/s and the legitimate load is 8 Gbit/s. Assume that the upstream stage preserves all legitimate traffic. The percentages below are the attack fraction still arriving at the next stage, not the fraction blocked. All rates must use the same accounting layer.
If the 10 Gbit/s link sits before further filtering, the first two cases exceed its nominal rate. The last leaves only 1 Gbit/s of nominal margin, before encapsulation, bursts, growth or failure reserve. If local filtering comes before the handoff, measure its actual output instead: this table does not predict what a filter will remove. Repeat the budget at every constrained segment, not only at the customer port.
A smaller residual bitrate can still carry a demanding packet rate or create state pressure. An upstream reduction ratio says nothing about legitimate packets lost, game connections accepted or application response time. Capture those outcomes separately and agree on an acceptable limit before accepting the design.
| Attack left after upstream reduction | Residual attack | Residual attack + legitimate load |
|---|---|---|
| 1% | 10 Gbit/s | 18 Gbit/s |
| 0.3% | 3 Gbit/s | 11 Gbit/s |
| 0.1% | 1 Gbit/s | 9 Gbit/s |
Common mistakes before buying 1Tbps DDoS mitigation
The first mistake is comparing only the capacity number. Two providers may both advertise 1Tbps, while one has better handoff, better network proximity, more precise rules and faster support. The second mistake is ignoring packets per second. Many incidents do not break infrastructure through total bandwidth, but through queue pressure, interrupts, state tables or worker exhaustion.
The third mistake is not testing the return path. A poorly sized tunnel, forgotten MTU, inconsistent return route or unmanaged asymmetry can create loss even when mitigation works. The fourth mistake is placing all traffic behind a rule that is too aggressive. Good protection reduces the attack without turning legitimate users into collateral damage.
- Buying only a Tbps number without asking for the architecture.
- Ignoring PPS, CPU, port and firewall-state limits.
- Not validating GRE, IPIP, VXLAN, BGP or cross-connect before an emergency.
- Operating without monitoring during the attack.
- Confusing an application reverse proxy with upstream volumetric mitigation.
FAQ about 1Tbps DDoS mitigation
Does 1Tbps DDoS mitigation guarantee my service will never go down?
No. Capacity matters, but availability also depends on attack type, PPS, handoff, routing, rules and the ability of your infrastructure to receive clean traffic.
Do I need an ASN and BGP?
No. BGP is ideal for prefixes and network infrastructure, but protected IPs, GRE/IPIP/VXLAN or reverse proxy delivery can fit customers without their own ASN.
What is the difference between 1Tbps Anti-DDoS and protected IP transit?
Anti-DDoS describes filtering and capacity. Protected IP transit describes the full network model: traffic ingress, optional announcement, mitigation and clean traffic handoff.
Is a FiveM or Minecraft reverse proxy enough against 1Tbps?
Not always. Reverse proxies help with protocol context and anti-bot logic, but very large volumetric attacks should be reduced upstream before they reach the application layer.
