Bandwidth is not the bottleneck
Bandwidth measures how much data is transferred. Packet rate measures how much work the system has to do.
A system can retain unused link bandwidth while its packet-processing capacity is already exhausted.
Packet-rate constraints
Every packet requires processing: parsing headers, lookup, filtering, forwarding decisions.
This cost is mostly constant per packet, not per byte. Smaller packets increase the workload dramatically.
System impact
- 64-byte floods create maximum PPS pressure
- Firewalls collapse long before links are full
- Conntrack and stateful systems fail first
- Routers hit CPU limits before line rate
Mitigation requirements
Attack analysis must include both bandwidth and packet rate. A lower-bandwidth attack can still exhaust packet-processing capacity.
Effective mitigation focuses on reducing packet processing cost and avoiding unnecessary state.
DDoS protection from SMARTNET
Connection options, filtering capabilities and service limits.
View DDoS protection