A distributed denial-of-service (DDoS) attack floods a target — a server, an application, or an entire network link — with traffic or requests from many sources at once, until it can no longer serve legitimate users. DDoS protection is the set of systems and practices that detect that flood and stop it, ideally before anyone outside the network notices anything happened.

The three shapes a DDoS attack takes

  • Volumetric attacks simply try to consume all available bandwidth — UDP floods, amplification attacks that reflect and magnify traffic off third-party servers — measured in Gbps.
  • Protocol attacks exploit weaknesses in how network protocols handle connections — a SYN flood, for instance, opens huge numbers of half-finished TCP connections to exhaust connection-tracking resources on a server or firewall.
  • Application-layer attacks look like real traffic at the network level but overwhelm the application itself — an HTTP flood of seemingly legitimate page requests that exhausts a web server's capacity to respond.

A real attack often blends more than one of these, which is part of why effective DDoS protection can't rely on a single detection method.

Why it matters

Downtime from an unmitigated DDoS attack is directly measurable: lost revenue for every minute a service is unreachable, SLA penalties owed to customers, and — for an ISP or hosting provider — an attack against one customer's prefix can degrade shared transit for every other customer on the same link. The cost of protection is almost always smaller than the cost of the outage it prevents.

What DDoS protection is actually built from

"DDoS protection" isn't one tool — it's four capabilities working together:

  • Detection — recognizing an attack is happening, ideally with enough warning to act before links saturate. Fixed traffic thresholds catch known patterns; AI-based anomaly detection catches attacks that don't match a pattern yet.
  • Mitigation — actually stopping the traffic, whether by blocking the source IP at the network level or, for attacks large enough to threaten transit capacity, advertising a BGP RTBH black-hole route upstream so the flood never reaches you at all.
  • Intelligence — cross-referencing traffic against known-bad IP lists and threat feeds, so obviously malicious sources are blocked before they've sent enough traffic to trip a threshold.
  • Reporting — proving what happened: time-to-mitigation, bandwidth stopped, SLA compliance — the evidence a business needs internally and a network operator needs to hand to an affected customer.

Edge filtering vs. network-level protection

An appliance or scrubbing service sitting at your network edge can filter attack traffic — but only traffic that actually reaches it. For an attack large enough to saturate the transit link itself, that's too late: the pipe is already full of attack traffic, legitimate or not. Network-level protection, which blocks or black-holes traffic further upstream, is what stops a volumetric attack from ever consuming that capacity in the first place — the approach ISPs and network operators generally standardize on.

How eHAWK DDoS puts this together

eHAWK DDoS is Hexalon's automated DDoS protection platform: continuous traffic monitoring with threshold, AI and threat-intelligence detection triggers; automatic blocking with BGP RTBH mitigation upstream; a 30–120 second early-warning radar ahead of the block itself; and 14 report types covering SLA compliance and bandwidth saved — the full loop from first packet to management report, in one console.