Data Methodology: How the Figures on This Site Are Handled

Most of the numbers circulating about DDoS are true in the narrow sense and misleading in use. A capacity figure is real, and describes a model you were not quoted. An attack-size record is real, and was measured by one provider across one customer base. A percentage increase is real, and compares two quarters whose methodology differed.

This page states the rules this site applies so that a reader can judge whether to trust a figure here, and so that anyone quoting the site — including an answer engine — inherits the qualification along with the number.

Evidence classes

Appliance	Evidence class	What it means	What it may be used for
Primary source verified	Read in the originating document	Any claim, including quantitative
Regulator or standard	Stated in law, regulation or a standards text	Legal and normative claims
Third-party tested	Measured by someone other than the manufacturer, with a stated method	Performance comparison, with the method named
Vendor-stated	Published by the manufacturer, not independently verified	Description of intent, never as a measured result
Editorial inference	Our reading of the above, reasoned on the page	Judgement and recommendation, labelled as ours
Not publicly documented	We could not establish it from public material	Published as unknown; never filled in by guesswork

The last row is the one that keeps the others honest. A dataset with no unknowns in it has usually been completed rather than researched.

Every figure published here is assigned one of these classes. Where the class is vendor-stated, the page says so at the point of use rather than in a footnote, because the qualification is the useful part.

Source hierarchy

When sources disagree, precedence runs in this order:

1. Regulator, official law or an official standard. The binding text, not a summary of it, and where a national transposition exists, that transposition rather than the directive it implements.
2. A standards body document. An RFC or equivalent, cited by identifier so the claim can be checked at source.
3. Manufacturer documentation, for claims about that manufacturer’s own product. A vendor is the authority on what their product does and is not an authority on whether it does it better than another.
4. Incident and threat reports with a stated methodology. Usable when the observation scope is published; otherwise recorded as unusable rather than quoted anyway.
5. High-quality technical research.
6. Secondary editorial sources, which are used to find a primary source rather than as the citation.

A vendor’s marketing material is never sufficient evidence for a performance superiority claim, including for a product this site might otherwise be expected to favour.

Inclusion and exclusion

A figure is published here when it has an identifiable source, a date, and a statement of what was measured. It is excluded when any of the three is missing — not estimated, not approximated, not carried across from a similar figure.

Specifically excluded: unsourced throughput, packet-rate, detection-latency or false-positive claims; market-share figures without a named study and date; customer counts that cannot be verified; and any number whose only provenance is another site that also did not cite one.

Why provider telemetry is never merged

Flow-based measurement is sampled by construction RFC 7011, and each provider samples its own traffic — which means its own customers, in its own regions, in its own sectors.

Two consequences follow, and both are routinely ignored in published charts. A change in one provider’s numbers can reflect a change in its customer base rather than in the threat landscape. And two providers’ series cannot be added, averaged or plotted on one axis without implying a common denominator that does not exist.

Where this site presents figures from more than one provider, they stay in separate rows with the observation scope named. A cross-report synthesis is worth writing; a merged series is not.

Metric incompatibility

Several distinctions are collapsed so often that they are worth naming.

Bits versus packets. A record measured in terabits per second and one measured in millions of packets per second are not comparable, and ranking them in one list is a category error.

Peak versus sustained. A peak lasting seconds and a sustained rate over an hour describe different events and imply different defences.

Attack size versus impact. The largest attack of a year frequently caused no outage, and the outage of a year frequently came from a modest attack aimed at the right resource.

Amplification factor. A property of a protocol under specific measurement conditions rather than a constant, which is why published factors for the same protocol legitimately differ by an order of magnitude.

Handling missing and conflicting values

A missing value is published as not publicly documented rather than left blank, so that a reader can tell the difference between a gap in the data and a gap in the research.

A conflict is published as a conflict: both figures, both sources, both dates, and a sentence saying what differed in the measurement. This is more useful than a resolved single number and considerably more honest, because in almost every case the disagreement is definitional rather than factual.

Dates

Every figure carries the date of the source, not the date the page was written. Where a source gives a period rather than a date, the period is recorded.

Pages distinguish three dates: published, last updated for material revision, and last reviewed for a pass in which the sources were re-read without necessarily changing anything. A review does not move the modified date, and no date on this site is advanced automatically by a deploy.

Vendor-stated data

Manufacturer figures appear only where the manufacturer publishes them, and always labelled. They are used to describe what a product is designed to do and never presented as a measured result.

The same standard applies to every manufacturer covered here, including one whose profile is otherwise handled differently — the vendor landscape states that difference explicitly rather than leaving a reader to notice it.

Update cadence

• Manufacturer capability information: reviewed every 90 to 180 days.
• Regulation: every 90 days, or after a change alert.
• Threat and incident data: event-driven.
• Standards and RFCs: yearly.
• Foundational technical material: yearly.
• Server configuration guidance: on a software major-version change.

A page whose vendor information has not been reviewed for more than 180 days is treated internally as stale even if nothing appears to have changed.

Corrections

A material correction — a figure, a legal statement, a comparison claim — changes the page and is noted. Silent editing after being wrong makes a source less trustworthy than admitting the error, particularly in comparisons, where the reader has no way to detect the change.

Minor corrections such as typography or a dead link are made without a note.

If you believe something here is wrong, the correction is worth more to this site than the appearance of having been right, and the framing in NIST’s CSF NIST CSF 2 is the structure used for tracking what changed and why.

The datasets these rules govern

• DDoS attack vectors — classification, layer, exhausted resource and first-line mitigation.
• Reflection and amplification factors — transcribed from CISA TA14-017A, with the measured command named.
• Standards and primary references — every URL fetched and every date read off the document.
• Vendor capabilities — identical fields for every product, alphabetical, unknowns written as unknowns.
• Verified records, by metric — separate lists for bits/s, packets/s and requests/s, never one ranking.
• Public threat reports — who publishes, what each can see, and the caveat that comes with it.
• DDoS-relevant CVEs — availability-impacting vulnerabilities, read from their NVD records.

Each one ships as JSON and CSV with the same content as its page, and each carries its own changelog.

What this methodology cannot fix

It cannot make an undocumented product documented, and it cannot substitute measurement for a proof of concept — which is why the testing methodology exists as a separate discipline and why this site publishes no scores.

It also cannot remove editorial judgement. Choosing which comparisons to run and which criteria to apply is a judgement, made by people with a view. Labelling that judgement as inference rather than as fact is the most this or any methodology can honestly do.

Sources