A volumetric attack's whole strategy is brute force — overwhelm available bandwidth with sheer traffic volume, whether that's a direct flood or an amplification attack that reflects and multiplies traffic off third-party servers. Detecting one early is mostly about watching the right signals before the flood actually saturates a link.

What makes an attack "volumetric"

Unlike a protocol attack exploiting a specific connection-handling weakness, or an application-layer attack mimicking legitimate requests, a volumetric attack doesn't need to be clever — UDP floods, ICMP floods, and DNS or NTP amplification all work simply by exceeding the capacity of the link they're aimed at.

The core signal: traffic volume against a threshold

The baseline detection method is straightforward — measure packets-per-second and bits-per-second against a configured threshold, and flag anything that crosses it. Getting the threshold right matters: too low and normal traffic spikes trigger false alarms; too high and an attack has room to do real damage before it's flagged.

Secondary signals worth watching

  • Source concentration — an unusual number of packets suddenly arriving from a small set of IPs, ASNs or a single country.
  • Protocol mix shifts — a sudden spike in UDP or ICMP traffic relative to a network's normal baseline.
  • Amplification fingerprints — disproportionately large response packets from open DNS, NTP or similar reflective services, a signature of amplification attacks specifically.

Why early warning matters as much as the block

A threshold that only fires once traffic has already crossed the block line gives zero lead time. Scanning continuously for traffic that's rising toward — but hasn't yet crossed — that threshold gives a genuine head start: enough time to prepare mitigation, alert a NOC, or pre-stage a BGP RTBH announcement before the attack peaks.

How eHAWK detects volumetric attacks

eHAWK DDoS's early warning radar scans every 12 seconds for IPs behaving suspiciously below the block threshold, giving a 30–120 second head start with CRITICAL, HIGH or MEDIUM risk levels — on top of the standard threshold, AI and threat-intelligence triggers that drive the automatic block itself.