On this page
Locate the first constrained component
A correctly configured host firewall cannot recover access when the incoming link is already saturated. Upstream protection addresses that transport constraint; local filtering applies to traffic delivered to the machine. Ask where both boundaries lie and which counters are available. Physical-port, virtual-network and application statistics may describe different traffic.
Own the services you publish
Inventory listening ports, outbound dependencies and administration access. Network DDoS protection does not repair vulnerable applications, weak credentials or missing backups. Define an application-level availability test: an established TCP connection does not prove that authentication or database access works. Keep system maintenance responsibilities explicit.
Prepare evidence for support
Record affected addresses, protocols, timestamps and a reproducible failed user journey. Ask which filtering controls changed and whether the failure occurs before or after delivery to the server. Agree who may change network rules and who operates the host. During an incident, this boundary is more useful than a platform-wide capacity figure without a defined service scope.
