What are the layers of DDoS defense, and what does each handle?

Question

Accepted Answer

DDoS defense is **defense in depth**: no single control stops every attack, so you stack layers that each absorb, filter, or block a different class of traffic. The order matters — push as much work as possible to the edge, away from your origin.

## The layers, from edge inward

- **CDN / scrubbing centers** (Cloudflare, Akamai, AWS Shield) — the outermost layer. With **anycast**, the same IP is announced from many points of presence, so a volumetric flood is **spread across global capacity** instead of one data center. Scrubbing centers absorb the flood and forward only clean traffic.
- **WAF (Web Application Firewall)** — inspects HTTP requests and blocks malicious patterns: bad signatures, suspicious user agents, known bad IPs, and **Layer 7** floods that mimic real requests.
- **Rate limiting** — caps requests per IP, API key, or user over a time window, returning `429 Too Many Requests`. Stops abusive clients without harming normal ones.
- **Upstream / ISP blackhole (null-route)** — the last resort for raw volume. The provider drops all traffic to the targeted IP (**remotely-triggered blackhole, RTBH**), sacrificing that one IP to protect everything else.
- **Autoscaling + overprovisioning** — extra origin capacity to **absorb** what slips through, buying time while other layers engage.

## How they work together

The mental model is **absorb -> filter -> block**:

```text
Internet flood
  -> CDN + anycast      : ABSORB volume across global PoPs
  -> scrubbing          : drop obvious junk (L3/L4 floods)
  -> WAF                : FILTER malicious HTTP (L7)
  -> rate limiting       : throttle abusive clients (429)
  -> origin (autoscaled) : serve the clean remainder
  -> ISP null-route      : last resort if origin IP is overwhelmed
```

Volumetric attacks die at the CDN/scrubbing layer; application-layer attacks that look like real traffic get filtered by the WAF and rate limiter.

## Why it matters

Relying on one layer fails predictably: a WAF cannot stop a 1 Tbps flood (the pipe saturates first), and a CDN alone will happily pass a clever HTTP flood through to your origin. Layering means each attack class meets a control designed for it, and the origin only ever sees traffic the outer layers could not handle on their own.