Common failure points
- Firewalls hit CPU limits before line rate
- Conntrack becomes unusable under flow churn
- Stateful mitigation paths fail earlier than simple filters
- Customer services go down even while transit links still have headroom
SmartMitigate
High PPS DDoS Protection
A DDoS attack can exhaust a router or firewall before its uplink is full. Packet rate matters as much as bandwidth.
Packet rate and system limits
Small packets maximize per-packet work. Routers, firewalls and software mitigation paths still have to parse, classify and decide on every packet, even when the traffic volume in Gbps looks moderate.
Services can fail at relatively low bandwidth during 64-byte floods because packet-processing capacity is exhausted first.
Kernel processing and per-flow state can become bottlenecks when packet rates are high.
Early filtering reduces the amount of work performed by firewalls and application hosts.
Mitigation must account for packets per second as well as bandwidth. High-rate traffic should be filtered before expensive stateful processing.
Discarding attack packets early reduces the state and CPU work required downstream.
The reference articles below explain packet rate and bandwidth.
A service can fail from packet rate even when the uplink still has bandwidth available.
When this matters most
- 64-byte packet floods
- High PPS SYN or ACK attacks
- Environments relying on software firewalls at the edge
- Cases where the link stays up but services still become unusable