How to handle 100Mpps+ DDoS traffic without exhausting your infrastructure
Handling 100Mpps+ requires an architecture designed for packet rate, not only for Gbps: early detection, upstream relief, fast filtering and clean traffic delivery.
Anti-DDoS 软件与过滤架构。
软件、包处理框架、服务器和网络容量是不同的选择。通过这些指南明确过滤路径、测试条件，并记录平台实际能够持续承受的负载。
Defense Fabric 是用于自有服务器和网络链路的授权过滤软件。许可证不会增加上游带宽。端口标注的 100G 或 400G 是物理链路属性，不是实测缓解攻击能力。
建议阅读顺序
区分软件组件
区分 XDP 执行模式、DPDK 数据包输入输出和 VPP 转发，以及基于它们构建的检测与过滤策略。仅凭框架名称无法判断防护产品能力。
确定数据包与链路容量预算
分别计算入站和出站，记录帧长口径并纳入小包场景。使用计划中的规则验证网卡队列、PCIe、NUMA、CPU 和内存。
测试完整过滤路径
验证清洗后回程、有状态流量、路由变化和过滤节点故障。测量可接受丢包、连接行为及恢复过程，再判断聚合容量能否实际投入使用。
本专题指南
13 篇指南部分指南仅提供英文版。打开前即可看到语言标识。
13 / 13 篇指南
DDoS protection: hardware or software?
Compare placement, capacity, filtering policy, failure behavior and operating cost before choosing an appliance, software dataplane or managed protected transit.
What is a DDoS scrubbing center? Traffic paths, ownership and buying criteria
Understand what a scrubbing center does, what the advertised capacity does not establish, and how to choose between protected transit and your own filtering infrastructure.
How a DDoS scrubbing center works: attraction, filtering, delivery and recovery
Follow the operating chain with explicit authorization, matched observations, bounded policy changes and application checks before declaring recovery.
DDoS mitigation architecture: design the complete path
Map detection, routing, packet filtering and traffic delivery, then verify capacity, return paths, MTU and recovery before putting an architecture into service.
1Tbps DDoS mitigation: architecture, real limits and clean traffic handoff
A technical guide to what 1Tbps DDoS mitigation really means: upstream capacity, PPS saturation, BGP, FlowSpec, tunnels, cross-connects, clean traffic delivery and the mistakes to avoid before buying premium protection.
Custom XDP for DDoS: when it is worth building
Decide whether custom XDP solves your bottleneck, distinguish its execution modes and define the traffic, measurements and rollback needed before deployment.
Dedicated Anti-DDoS filtering server: what is it really for?
A dedicated Anti-DDoS filtering server separates production from the decision layer, enables more precise logic and keeps the existing stack behind it. This guide explains when the model makes sense, when it does not and how to place it cleanly inside the architecture.
Protected dedicated servers: define the responsibilities
Separate upstream protection, host firewall policy and application operations before exposing a service.
Build a filtering stack behind upstream mitigation
Assign transport protection, early packet checks, connection policy and application controls distinct duties, with a measurable path through each layer.
High-PPS filtering: examine receive queues and CPU placement
Inspect RSS distribution, memory locality and per-rule costs before adding processing cores.
How do you mitigate a DDoS attack above 100Gbps?
Mitigating a DDoS attack above 100Gbps requires far more than a large headline capacity number. This guide covers link saturation, PPS, CPU, upstream pre-filtering, dedicated filtering servers and clean traffic handoff to build a credible design.
XDP vs DPDK for Anti-DDoS filtering: which one should you choose?
The XDP vs DPDK Anti-DDoS question comes up all the time. This guide gives a practical answer for network and security teams: what XDP does extremely well, when DPDK becomes the right tool and which approach usually offers the best cost, performance and operations ratio.
没有匹配的指南。请尝试协议名称或更短的关键词。
从架构设计走向受支持的部署。
Defense Fabric 指南说明当前安装与集成要求。比较页面区分各厂商的检测、过滤和编排组件，并提供来源链接。