What is a DDoS attack; at which layers does TR7 provide DDoS protection?

Short answer

DDoS (Distributed Denial of Service) is an attack that makes a service unavailable to legitimate users with traffic sent from a large number of sources (NIST definition); the aim is not to steal data but to exhaust the bandwidth, the connection tables or the server resources. TR7 counters DDoS at two layers: L4 DDoS Protection comes ready in every route table and filters the traffic at the packet and connection level before any request has formed; L7 DDoS Protection, on the other hand, measures the request and connection volume with a time window on HTTP and L7 TCP vServices on which L7 DDoS & Threat Protection is turned on. Known DDoS sources are kept in the IP Intelligence & Reputation database with the DDoS Attack category; on vServices with Bot/DDoS protection on, IP Reputation Protection puts this category into Quarantine by default.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management	TCP, UDP, ICMP & reflection, Packet integrity and TR7 management access bands	Flood, scan and malformed packet rules at the packet and connection level
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Live View	Threat strip, quarantine table	Monitoring the rules under pressure at that moment and the sources in quarantine
vService form → Details	L7 DDoS & Threat Protection	Turning on Bot/DDoS protection on HTTP and L7 TCP vServices
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	L7 DDoS Protection card	Request and connection volume limits per vService
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Event Logs	Pillar column; the L7 DDoS tab of the record preview	Seeing the decisions of L7 DDoS Protection, the limit rule that was triggered and the measured value
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP Categories → DDoS Attack	Addresses known to have taken part in DDoS attacks

• Comparison of the two layers: What is the difference between L4 DDoS Protection and L7 DDoS Protection?
• Attacks carried out not with volume but with expensive requests: What is Application DoS; how does it differ from volumetric DDoS?

Common Misconceptions

• "WAF stops DDoS." WAF looks at the content of the request; volume-based attacks are countered by L4 DDoS Protection and L7 DDoS Protection.
• "A single layer is enough." An incomplete TCP handshake never turns into an HTTP request; for this reason L7 DDoS Protection cannot see it, and it is filtered at the L4 layer. A request flood with a flawless format, on the other hand, is not caught by L4 rules; it is measured by the L7 layer.
• "As soon as protection is turned on, all the rules block traffic." In L4 DDoS Protection, the default value of the rules that measure the flood rate (e.g. SYN Flood: New-TCP Rate, UDP Flood: New-UDP Rate) is Monitor; in this mode the rule only measures and does not drop packets (the modes of the rules). Most of the malformed packet and scan signatures, by contrast, are Block by default, as are the Management Ports rules. L7 DDoS Protection likewise starts in Monitor mode when protection is turned on (starting modes); for enforcement, the mode is changed manually.

How it is done in the documentation

• L4 DDoS Protection · What Is L4 DDoS Protection?
• L4 DDoS Protection · The Difference from Bot/DDoS and WAF
• L7 DDoS Protection · What Is L7 DDoS Protection?
• How to Enable Bot/DDoS Protection? · The Starting Modes of the Three Protections
• IP Intelligence & Reputation · IP Categories

Related questions

• What is the difference between L4 DDoS Protection and L7 DDoS Protection?
• What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?
• What is a botnet; how does TR7 detect a distributed attack originating from a botnet?
• What is Application DoS; how does it differ from volumetric DDoS?