{
  "schemaVersion": "1.0",
  "dataset": "ddos-standards",
  "title": "DDoS standards and primary references",
  "description": "RFCs, BCPs and NIST publications with direct DDoS relevance. Every URL fetched and every publication date read off the document itself.",
  "lastUpdated": "2026-08-15",
  "license": "Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.",
  "sources": [
    {
      "id": "rfc-editor",
      "title": "RFC Editor document repository",
      "publisher": "IETF / RFC Editor",
      "url": "https://www.rfc-editor.org/",
      "accessedDate": "2026-08-15",
      "notes": "Each RFC row was fetched individually; publication months were read from the document headers."
    },
    {
      "id": "nist-csrc",
      "title": "NIST Computer Security Resource Center publication pages",
      "publisher": "NIST",
      "url": "https://csrc.nist.gov/",
      "accessedDate": "2026-08-15"
    }
  ],
  "changelog": [
    {
      "date": "2026-08-15",
      "note": "Initial release: 17 verified entries."
    }
  ],
  "rowCount": 17,
  "data": [
    {
      "identifier": "RFC 4732",
      "title": "Internet Denial-of-Service Considerations",
      "publisher": "IETF",
      "published": "2006-11",
      "category": "attack analysis",
      "ddosRelevance": "The reference framing of denial of service as resource exhaustion, and of which parts of the problem are structural rather than fixable.",
      "url": "https://www.rfc-editor.org/rfc/rfc4732.html"
    },
    {
      "identifier": "RFC 4987",
      "title": "TCP SYN Flooding Attacks and Common Mitigations",
      "publisher": "IETF",
      "published": "2007-08",
      "category": "attack analysis",
      "ddosRelevance": "The canonical description of SYN flooding and of the countermeasures — SYN cookies and SYN proxying included — with their trade-offs stated.",
      "url": "https://www.rfc-editor.org/rfc/rfc4987.html"
    },
    {
      "identifier": "RFC 2827 (BCP 38)",
      "title": "Network Ingress Filtering",
      "publisher": "IETF",
      "published": "2000-05",
      "category": "filtering",
      "ddosRelevance": "The source-address validation baseline that limits spoofing, and therefore reflection. Protects others from your network rather than the reverse.",
      "url": "https://www.rfc-editor.org/rfc/rfc2827.html"
    },
    {
      "identifier": "RFC 3704 (BCP 84)",
      "title": "Ingress Filtering for Multihomed Networks",
      "publisher": "IETF",
      "published": "2004-03",
      "category": "filtering",
      "ddosRelevance": "Extends BCP 38 to multihomed networks, where strict uRPF starts dropping legitimate traffic and the looser modes defined here become necessary.",
      "url": "https://www.rfc-editor.org/rfc/rfc3704.html"
    },
    {
      "identifier": "RFC 5635",
      "title": "Remote Triggered Black Hole Filtering with uRPF",
      "publisher": "IETF",
      "published": "2009-08",
      "category": "filtering",
      "ddosRelevance": "The destination and source RTBH mechanisms: the blunt upstream instrument that stops saturation by completing the attack for one destination.",
      "url": "https://www.rfc-editor.org/rfc/rfc5635.html"
    },
    {
      "identifier": "RFC 8955",
      "title": "Dissemination of Flow Specification Rules",
      "publisher": "IETF",
      "published": "2020-12",
      "category": "filtering",
      "ddosRelevance": "BGP FlowSpec for IPv4: distributing match-and-action filtering rules rather than routes. Obsoletes RFC 5575. What an upstream will actually accept varies.",
      "url": "https://www.rfc-editor.org/rfc/rfc8955.html"
    },
    {
      "identifier": "RFC 8956",
      "title": "Dissemination of Flow Specification Rules for IPv6",
      "publisher": "IETF",
      "published": "2020-12",
      "category": "filtering",
      "ddosRelevance": "The IPv6 counterpart of RFC 8955.",
      "url": "https://www.rfc-editor.org/rfc/rfc8956.html"
    },
    {
      "identifier": "RFC 8811",
      "title": "DDoS Open Threat Signaling (DOTS) Architecture",
      "publisher": "IETF",
      "published": "2020-08",
      "category": "mitigation signalling",
      "ddosRelevance": "The architecture for standards-based mitigation requests between an entity under attack and an upstream mitigator.",
      "url": "https://www.rfc-editor.org/rfc/rfc8811.html"
    },
    {
      "identifier": "RFC 9132",
      "title": "DOTS Signal Channel Specification",
      "publisher": "IETF",
      "published": "2021-09",
      "category": "mitigation signalling",
      "ddosRelevance": "The DOTS channel designed to keep working while the network is under attack — the request-for-help path itself.",
      "url": "https://www.rfc-editor.org/rfc/rfc9132.html"
    },
    {
      "identifier": "RFC 8783",
      "title": "DOTS Data Channel Specification",
      "publisher": "IETF",
      "published": "2020-05",
      "category": "mitigation signalling",
      "ddosRelevance": "The DOTS configuration channel: filtering rules and aliases exchanged in peacetime rather than during the attack.",
      "url": "https://www.rfc-editor.org/rfc/rfc8783.html"
    },
    {
      "identifier": "RFC 4786",
      "title": "Operation of Anycast Services",
      "publisher": "IETF",
      "published": "2006-12",
      "category": "routing",
      "ddosRelevance": "The operational reference for anycast, which is how attack volume gets spread across sites instead of concentrating on one.",
      "url": "https://www.rfc-editor.org/rfc/rfc4786.html"
    },
    {
      "identifier": "RFC 7011",
      "title": "IPFIX Protocol Specification",
      "publisher": "IETF",
      "published": "2013-09",
      "category": "telemetry",
      "ddosRelevance": "The flow-export standard most detection telemetry speaks. Sampled by design, which bounds what flow-based detection can see.",
      "url": "https://www.rfc-editor.org/rfc/rfc7011.html"
    },
    {
      "identifier": "RFC 9210",
      "title": "DNS Transport over TCP — Operational Requirements",
      "publisher": "IETF",
      "published": "2022-03",
      "category": "operations",
      "ddosRelevance": "Makes TCP support mandatory for DNS operators — directly relevant to amplification pressure, since UDP answers are what reflection abuses.",
      "url": "https://www.rfc-editor.org/rfc/rfc9210.html"
    },
    {
      "identifier": "RFC 2544",
      "title": "Benchmarking Methodology for Network Interconnect Devices",
      "publisher": "IETF",
      "published": "1999-03",
      "category": "testing",
      "ddosRelevance": "Not a DDoS document, but the origin of the packet-size ladder (64 to 1518 bytes) that any honest capacity test still runs.",
      "url": "https://www.rfc-editor.org/rfc/rfc2544.html"
    },
    {
      "identifier": "NIST SP 800-61 Rev. 3",
      "title": "Incident Response Recommendations and Considerations for Cybersecurity Risk Management",
      "publisher": "NIST",
      "published": "2025-04",
      "category": "operations",
      "ddosRelevance": "The incident-response lifecycle most runbooks and regulatory expectations are structured against, reorganised around CSF 2.0 in this revision.",
      "url": "https://csrc.nist.gov/pubs/sp/800/61/r3/final"
    },
    {
      "identifier": "NIST CSF 2.0",
      "title": "The NIST Cybersecurity Framework 2.0",
      "publisher": "NIST",
      "published": "2024-02",
      "category": "framework",
      "ddosRelevance": "A workable organising frame for availability-risk evidence: govern, identify, protect, detect, respond, recover.",
      "url": "https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final"
    },
    {
      "identifier": "NIST SP 800-189",
      "title": "Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation",
      "publisher": "NIST",
      "published": "2019-12",
      "category": "routing",
      "ddosRelevance": "The NIST treatment of interdomain routing security and DDoS mitigation together — RTBH, FlowSpec and source-address validation in one operational frame.",
      "url": "https://csrc.nist.gov/pubs/sp/800/189/final"
    }
  ]
}