Can a volumetric DDoS attack be mitigated by some in house defense or does the defense always need to be on the cloud? If yes, then why?

1 Answer 1


It depends a bit on what you consider "in house". You cannot filter volumetric attacks once they're on your network, since your external link(s) are saturated. So the filtering has to be done before traffic hits your external link(s), for example by your upstream provider(s) or by some dedicated scrubbing service. This can either be blackholing (discarding all traffic to the target), or scrubbing (dropping unwanted traffic while letting valid traffic pass).

If your network is running BGP, the triggers for deciding to do this can often be coming from your network, for example by using a remotely triggered blackhole, which uses a BGP session to indicate to a BGP upstream that traffic to a specific target should be discarded, or by injecting more specific BGP routes which divert the prefix which contains the IP address which is under attack via a scrubbing center.

If your network isn't running BGP (but uses an upstream provider for this), an upstream provider may provide blackholing or scrubbing services, either automated (based on anomaly detection) via a customer portal or after contacting them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .