DDoS protection for ISPs and network operators

Three boundaries matter in an access network

Shared links and distributed targets

An attack spread across several subscriber addresses can stress a shared uplink even when no single destination dominates a graph. Observe traffic at the prefix and upstream levels as well as per address; a quiet endpoint does not prove the aggregate path has spare capacity.

Subscriber state and source sharing

CGNAT and stateful edge equipment can face connection pressure separately from link bandwidth. Many legitimate users can also share one public source address. A source limit therefore needs workload review, not just a low threshold applied across all subscribers.

More than one route owner

Your own prefixes, customer announcements and provider-assigned addresses may have different authorization and export rules. Define the protected scope, accepted announcements and default-route expectations before adding a protection path.

Combine upstream delivery with the controls you operate

Protected Transit IP can provide the network layer; compatible local filtering can serve a separate role behind it. A hybrid design still needs explicit ownership of diversion, filtering and restoration.

1. 1

   Observe the exposed paths

   Collect relevant router telemetry and interface counters with a known sampling interval and direction.

2. 2

   Deliver protected traffic

   Qualify the agreed tunnel or physical handoff, route selection, MTU and remaining delivery capacity.

3. 3

   Preserve subscriber service

   Check return traffic and normal subscriber applications with the selected local TCP and stateful modes.

Illustrative deployment sequence. The quotation and acceptance record define the delivered service.

Decisions to settle before an order

Who is allowed to announce the protected prefixes?

Document the ASN, prefix authorization, route filters and permitted propagation. BGP session state alone is not evidence that the intended routes are accepted.

Can return traffic bypass the local filter?

That depends on the selected protection mode. Validate the actual routing requirements before enabling stateful features; do not infer asymmetric support from the presence of multiple peers.

What may trigger a diversion?

Keep observation, authorization and enforcement distinct. Peeryx Flow Collector works out of path and uses the published authorized IPv4 /24 diversion scope; it does not supply network capacity or inline filtering.

Prove the access service survives the agreed change

• Record normal busy-hour traffic, successful subscriber connections and relevant state counters before enabling protection.
• Check accepted routes, both traffic directions and small and large transfers on every delivered path.
• Coordinate the chosen path or device failure test, record useful-service recovery and retain a rollback owner.

Questions for this deployment