DDoS defence happens at two different layers, and confusing them is a common reason protection strategies fail against large attacks. Application-layer defence — a WAF, a CDN, a scrubbing service — inspects and filters traffic that has already arrived. Network-level protection acts further upstream, on the routing infrastructure itself, before traffic ever reaches that point.
What network-level protection actually blocks
Network-level defence operates at Layers 3 and 4 — IP addresses, ports, protocols, packet volume — using routing changes rather than payload inspection. The signature technique is BGP RTBH black-holing: advertising a route that tells an upstream router to drop all traffic to a given destination, stopping the flood before it consumes any transit capacity at all.
Why it matters most for volumetric attacks
An application-layer defence can only filter traffic it receives — and a flood large enough to saturate the link itself has already caused the outage by the time it arrives, filtered or not. Network-level protection is the only layer that can stop a volumetric attack from ever consuming that capacity, which is why it's the layer ISPs and network operators build their DDoS strategy around first.
The trade-off: precision vs. reach
Application-layer tools can be very precise — blocking a specific malicious request pattern while letting everything else through. Network-level techniques like RTBH are blunter: dropping traffic to an entire destination IP, which is why they're typically reserved for confirmed, large-scale attacks rather than every anomaly.
Why both layers belong in a real strategy
Application-layer defence handles the attacks that are subtle and low-volume enough to reach you without saturating anything. Network-level defence handles the attacks large enough that letting them reach your edge at all is already the failure. A DDoS protection platform that only operates at one layer is only half covering the threat model.
How eHAWK DDoS operates at the network level
eHAWK DDoS combines automatic IP blocking at the network level with upstream BGP RTBH mitigation, configurable AS number, peer AS, neighbor IP and community string — plus effectiveness reporting showing how much traffic was stopped at the router versus only at your server.