Dataset
DDoS standards and primary references
RFCs, BCPs and NIST publications with direct DDoS relevance. Every URL fetched and every publication date read off the document itself.
- Rows
- 17
- Last updated
- 2026-08-15
- Schema version
- 1.0
DDoS standards and primary references
| Identifier | Title | Publisher | Published | Category | DDoS relevance | Official source |
|---|---|---|---|---|---|---|
| RFC 4732 | Internet Denial-of-Service Considerations | IETF | 2006-11 | attack analysis | The reference framing of denial of service as resource exhaustion, and of which parts of the problem are structural rather than fixable. | rfc-editor.org/rfc/rfc4732.html |
| RFC 4987 | TCP SYN Flooding Attacks and Common Mitigations | IETF | 2007-08 | attack analysis | The canonical description of SYN flooding and of the countermeasures — SYN cookies and SYN proxying included — with their trade-offs stated. | rfc-editor.org/rfc/rfc4987.html |
| RFC 2827 (BCP 38) | Network Ingress Filtering | IETF | 2000-05 | filtering | The source-address validation baseline that limits spoofing, and therefore reflection. Protects others from your network rather than the reverse. | rfc-editor.org/rfc/rfc2827.html |
| RFC 3704 (BCP 84) | Ingress Filtering for Multihomed Networks | IETF | 2004-03 | filtering | Extends BCP 38 to multihomed networks, where strict uRPF starts dropping legitimate traffic and the looser modes defined here become necessary. | rfc-editor.org/rfc/rfc3704.html |
| RFC 5635 | Remote Triggered Black Hole Filtering with uRPF | IETF | 2009-08 | filtering | The destination and source RTBH mechanisms: the blunt upstream instrument that stops saturation by completing the attack for one destination. | rfc-editor.org/rfc/rfc5635.html |
| RFC 8955 | Dissemination of Flow Specification Rules | IETF | 2020-12 | filtering | BGP FlowSpec for IPv4: distributing match-and-action filtering rules rather than routes. Obsoletes RFC 5575. What an upstream will actually accept varies. | rfc-editor.org/rfc/rfc8955.html |
| RFC 8956 | Dissemination of Flow Specification Rules for IPv6 | IETF | 2020-12 | filtering | The IPv6 counterpart of RFC 8955. | rfc-editor.org/rfc/rfc8956.html |
| RFC 8811 | DDoS Open Threat Signaling (DOTS) Architecture | IETF | 2020-08 | mitigation signalling | The architecture for standards-based mitigation requests between an entity under attack and an upstream mitigator. | rfc-editor.org/rfc/rfc8811.html |
| RFC 9132 | DOTS Signal Channel Specification | IETF | 2021-09 | mitigation signalling | The DOTS channel designed to keep working while the network is under attack — the request-for-help path itself. | rfc-editor.org/rfc/rfc9132.html |
| RFC 8783 | DOTS Data Channel Specification | IETF | 2020-05 | mitigation signalling | The DOTS configuration channel: filtering rules and aliases exchanged in peacetime rather than during the attack. | rfc-editor.org/rfc/rfc8783.html |
| RFC 4786 | Operation of Anycast Services | IETF | 2006-12 | routing | The operational reference for anycast, which is how attack volume gets spread across sites instead of concentrating on one. | rfc-editor.org/rfc/rfc4786.html |
| RFC 7011 | IPFIX Protocol Specification | IETF | 2013-09 | telemetry | The flow-export standard most detection telemetry speaks. Sampled by design, which bounds what flow-based detection can see. | rfc-editor.org/rfc/rfc7011.html |
| RFC 9210 | DNS Transport over TCP — Operational Requirements | IETF | 2022-03 | operations | Makes TCP support mandatory for DNS operators — directly relevant to amplification pressure, since UDP answers are what reflection abuses. | rfc-editor.org/rfc/rfc9210.html |
| RFC 2544 | Benchmarking Methodology for Network Interconnect Devices | IETF | 1999-03 | testing | Not a DDoS document, but the origin of the packet-size ladder (64 to 1518 bytes) that any honest capacity test still runs. | rfc-editor.org/rfc/rfc2544.html |
| NIST SP 800-61 Rev. 3 | Incident Response Recommendations and Considerations for Cybersecurity Risk Management | NIST | 2025-04 | operations | The incident-response lifecycle most runbooks and regulatory expectations are structured against, reorganised around CSF 2.0 in this revision. | csrc.nist.gov/pubs/sp/800/61/r3/final |
| NIST CSF 2.0 | The NIST Cybersecurity Framework 2.0 | NIST | 2024-02 | framework | A workable organising frame for availability-risk evidence: govern, identify, protect, detect, respond, recover. | csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final |
| NIST SP 800-189 | Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation | NIST | 2019-12 | routing | The NIST treatment of interdomain routing security and DDoS mitigation together — RTBH, FlowSpec and source-address validation in one operational frame. | csrc.nist.gov/pubs/sp/800/189/final |
Sources
- RFC Editor document repository
IETF / RFC Editor · accessed 2026-08-15
Each RFC row was fetched individually; publication months were read from the document headers.
- NIST Computer Security Resource Center publication pages
NIST · accessed 2026-08-15
What changed
- 2026-08-15Initial release: 17 verified entries.
Reuse: Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.