Foundation

DDoS Mitigation Glossary

Last updated: August 2026 · 110 terms, defined as they are used · Reading time ~32 min

Amplification factorBandwidth amplification factor · BAF

The ratio between the size of a request an attacker sends to a reflector and the size of the response the victim receives. It is a property of a protocol under particular measurement conditions rather than a fixed constant, which is why published factors for the same protocol differ: the request used, the data available on the reflector and the response the server chose to send all change the number. Treat any single published figure as an observation, not a specification.See also: Reflection, Amplification

Amplification

An attack technique in which a small request produces a much larger response, so that a modest amount of attacker bandwidth becomes a large amount of victim bandwidth. It requires a protocol that answers disproportionately and, in practice, a source address that can be forged. Amplification is what makes a small botnet capable of saturating a large circuit.See also: Reflection, Amplification factor, Spoofing

Anycast

Announcing the same IP prefix from many locations so that the network delivers each client to a topologically near one. For DDoS it spreads an attack across every site that announces the prefix, turning one saturated location into many partially loaded ones. It disperses volume; it does not reduce it, and it does nothing about an application-layer attack that follows a client to whichever site it reaches.See also: Scrubbing centre, Diversion

BaselineBehavioural baseline

A learned description of what normal traffic looks like for a given service, used to decide what counts as abnormal. Baselines take time to build, drift as the business changes, and are the reason a defence deployed the week before a seasonal peak frequently produces false positives during it. A baseline is an asset with a maintenance cost rather than a setting.See also: False positive, Goodput

BGP FlowSpecFlowSpec · RFC 8955

A BGP extension that distributes traffic-filtering rules — match on protocol, ports, packet length, fragment flags, and act by dropping, rate-limiting or redirecting — rather than routes. It is far more precise than blackholing because it can discard one vector while leaving the destination reachable. Carrier support and accepted rule complexity vary widely, so what your upstream will actually accept is a question to ask before the design depends on it.See also: RTBH, Diversion

Botnet

A set of compromised or volunteered hosts under common control, used here as an attack source. The relevant property for defence is not its size but its composition: residential devices produce traffic that looks plausible from a reputation standpoint, while hosting-provider sources are easier to judge on origin alone.See also: Spoofing

Carpet bombingSpread-spectrum attack

An attack that distributes traffic across many addresses in a target prefix rather than concentrating it on one, so that no single destination crosses a per-host threshold while the aggregate saturates the link. It is a detection problem before it is a mitigation problem: a defence that counts only per destination cannot see it.See also: Baseline, RTBH

Clean traffic

Traffic that has passed through mitigation and is being delivered to the origin. In a diversion design it has to get back somehow — normally through a tunnel — and that return path carries its own MTU, routing-asymmetry and failure questions that are independent of how well the cleaning was done.See also: Goodput, Diversion, Scrubbing centre

DDoSDistributed denial of service

An attempt to make a service unavailable by exhausting a resource it depends on, using many sources at once. The resource may be bandwidth, packet-processing capacity, connection-table entries, application worker threads or a backend database. Nothing is broken in the process; the service simply runs out.See also: State exhaustion, DDoS mitigation

DDoS mitigation

Keeping a service reachable while it is deliberately flooded, by detecting abnormal traffic, classifying what kind of attack it is and enforcing a response close enough to the source that legitimate requests still get through. Mitigation is the accurate word: the traffic does not stop arriving, it stops mattering.See also: DDoS, Goodput, Scrubbing centre

DiversionRedirection · Traffic steering

Moving traffic off its normal path and into a mitigation tier, usually by announcing a prefix from the scrubbing provider or by signalling. Because it is a routing change rather than an instruction, it converges on the network's schedule — which is why on-demand designs measure time-to-mitigate in minutes and always-on designs measure it in seconds.See also: Clean traffic, BGP FlowSpec, DOTS

DOTSDDoS Open Threat Signaling

A standards-based interface for an entity to ask an upstream mitigator for help and to exchange attack information, defined in a set of IETF documents covering the architecture, the signal channel and the data channel. It exists so that requesting mitigation does not require a vendor-specific integration. Implementation and adoption remain uneven, which is worth verifying rather than assuming.See also: Diversion, BGP FlowSpec

DPIDeep packet inspection

Examining packet payloads rather than only headers. It is what makes some application-layer decisions possible and what makes them expensive, and it is largely defeated by encryption unless the session is terminated first — which moves the question from "can it inspect" to "where are the keys and the plaintext allowed to be".See also: WAF, TLS termination

Elephant flow

A single flow carrying a disproportionate share of traffic. It matters for DDoS because hardware that distributes work across cores or queues by flow hash cannot spread one flow, so a single large flow can saturate one processing element while the device as a whole looks lightly loaded.See also: RSS, Mpps

False positive

Legitimate traffic that mitigation classified as attack traffic and acted on. It is the cost side of every tuning decision, it is invisible on a graph that only counts blocked attack traffic, and it is the number most likely to be absent from an acceptance test that was designed by someone selling the product.See also: Goodput, Baseline

Flow telemetryNetFlow · sFlow · IPFIX

Summaries of conversations exported by network devices — source, destination, ports, byte and packet counts — rather than the packets themselves. It scales to carrier networks and is normally sampled, which makes it strong evidence for volume and weak evidence for anything small or slow.See also: Baseline, Mpps

Goodput

The legitimate traffic that still reaches the service while mitigation is active. It is the metric that describes whether the business survived, as distinct from throughput, which describes what the device could process. A defence that blocks the attack completely and takes real customers with it has produced an outage with better graphs.See also: False positive, Clean traffic

GREGeneric Routing Encapsulation

A tunnelling protocol commonly used to return cleaned traffic from a scrubbing provider to the origin. The operational consequence is a reduced usable MTU, which makes path MTU discovery and TCP MSS clamping part of the availability design rather than a detail.See also: Clean traffic, Scrubbing centre

Inline

A deployment in which the device sits in the traffic path and every packet passes through it. It can act on the first bad packet and sees both directions of a session, which is what makes protocol-state and application-layer decisions possible. In exchange, its failure modes and bypass behaviour become part of the service's availability.See also: Out-of-path, SYN proxy

MppsMillion packets per second · Packet rate

The rate at which packets are processed, independent of their size. It is the constraint that decides most protocol-layer outcomes, and it is why a device rated for a large bit-rate figure may fail well below it when the packets are small — the per-packet work is roughly constant while the bits per packet are not.See also: PPS, Elephant flow

Multi-tenancy

The ability to run separate protection policies, thresholds and reporting for different customers on shared hardware. For a service provider it is the difference between selling protection as a product and operating one shared policy that satisfies nobody precisely. The properties to verify are policy isolation, telemetry separation and what one tenant's incident does to another's service.See also: DDoS mitigation

Out-of-pathOut-of-band

A deployment in which the device sees copies of traffic or flow records and traffic is diverted to it only when needed. Nothing sits in the path in steady state, which removes a class of risk, at the cost of the diversion delay at the start of every incident.See also: Inline, Diversion

PPSPackets per second

The unit in which packet-rate capacity and packet-rate attacks are measured. Sizing a defence in bits per second alone leaves the packet-rate ceiling unstated, which is the most common way a correctly sized purchase turns out to be undersized.See also: Mpps

Reflection

Sending requests with the victim's address forged as the source, so that innocent third-party servers send their responses to the victim. It hides the true origin and, combined with a protocol that answers disproportionately, multiplies the attacker's bandwidth.See also: Amplification, Spoofing

RSSReceive Side Scaling

A network-interface feature that distributes incoming packets across multiple receive queues and CPU cores by hashing flow identifiers. It is what allows a host to process high packet rates at all, and its limits explain why a single flow, or an attack that hashes to few queues, can overload one core while the others idle.See also: Elephant flow, Mpps

RTBHRemotely triggered black hole filtering

Asking an upstream network to discard all traffic to a destination address, by announcing it with an agreed community. It reliably stops saturation from reaching your circuit and completes the attacker's goal for the destination in question, which makes it a deliberate sacrifice rather than a defence — and a valuable one when the alternative is losing everything behind the same circuit.See also: BGP FlowSpec, Carpet bombing

Scrubbing centreScrubbing center · Cleaning centre

A facility with substantially more capacity than a customer circuit, to which traffic is diverted so that attack traffic can be removed and the remainder returned. It answers volume, which is the part an on-premises tier structurally cannot, and it holds the telemetry and the decision on the provider's side unless the contract says otherwise.See also: Diversion, Clean traffic, GRE

SpoofingSource address spoofing

Forging the source address of a packet. It is what makes reflection possible and what makes attribution by source address unreliable. Ingress filtering at network borders is the countermeasure, and because it protects everyone except the network that deploys it, adoption remains partial.See also: Reflection, uRPF

State exhaustion

An attack that consumes the entries a device keeps for each session — half-open connection slots, session-table rows, reassembly buffers — rather than bandwidth. It is why a firewall rated in tens of gigabits can be taken down by a few hundred megabits of well-chosen packets, and why sizing a defence by bandwidth alone misses a whole attack family.See also: SYN proxy, DDoS

SYN proxySYN cookies

A defence against SYN floods in which the protecting device completes the handshake on behalf of the server and only establishes a real session once the client proves it is genuinely there. SYN cookies achieve something similar by encoding state in the sequence number rather than storing it, which trades some TCP option fidelity for not having a table to exhaust.See also: State exhaustion, Inline

TLS termination

Decrypting a session so its contents can be inspected or served. Application-layer defence generally requires it, which turns a technical decision into a jurisdictional one: whoever terminates the session holds the keys and sees the plaintext, and where that happens is frequently what a data-protection regime actually cares about.See also: DPI, WAF

uRPFUnicast Reverse Path Forwarding

A router check that discards a packet if the route back to its source address does not point out of the interface the packet arrived on. It is the usual mechanism for ingress filtering, and it needs care on multihomed networks where asymmetric routing makes the strict form drop legitimate traffic.See also: Spoofing, RTBH

WAFWeb application firewall

A control that inspects HTTP requests after the session has been accepted and terminated, to block application-layer abuse. It genuinely overlaps with application-layer DDoS defence and does not overlap at all with floods that never complete a handshake, because those never reach it.See also: TLS termination, DPI, State exhaustion

XDP / eBPF

A Linux facility for running filtering programs at the earliest point in the network driver, before the kernel builds its usual per-packet structures. It allows very high drop rates on commodity hardware, which makes it a real option for volumetric filtering at the host, bounded by the fact that a packet still has to arrive on the wire to be dropped.See also: Mpps, RSS

ACK flood

A flood of TCP packets carrying the ACK flag, which forces a stateful device to look up each one against its session table and find nothing. The cost to the sender is one packet; the cost to the receiver is a table lookup and, on some designs, a response. It passes straight through defences that only validate handshakes.See also: State exhaustion, SYN flood

Always-on mitigation

A posture in which mitigation is applied continuously rather than started when something is detected. It removes the detection-to-action delay and imposes whatever cost the mitigation carries — added latency, connection handling, false positives — permanently rather than occasionally.See also: On-demand mitigation, Inline

On-demand mitigation

A posture in which normal traffic passes untouched and mitigation begins once an attack is detected. The cost is the window between the first attack packet and the moment enforcement takes effect, which for diversion-based designs includes route convergence.See also: Always-on mitigation, Diversion

Application-layer attackLayer 7 attack · L7 attack

An attack made of well-formed requests whose cost to the server greatly exceeds their cost to the client. Nothing at the packet layer distinguishes it from popularity, so detection needs session behaviour, client characteristics or the application's own semantics.See also: HTTP flood, Goodput

Autonomous System NumberASN

The identifier for a network that runs its own routing policy on the internet. It matters in DDoS work because attack sources and legitimate traffic are frequently reasoned about per ASN rather than per address, and because blocking one refuses everyone behind it.See also: Prefix, BGP FlowSpec

Backscatter

Responses sent to forged source addresses by hosts that were themselves attacked. A network receiving backscatter is seeing evidence of an attack somewhere else in which its addresses were used as the forgery, which is a useful signal and an unpleasant surprise.See also: Spoofing, Reflection

BlackholeNull route

Discarding all traffic destined for an address, usually by routing it to a discard interface. It is fast and completely effective at protecting everything else, and it completes the denial of service against the target — which makes it a business decision rather than an operational one.See also: RTBH, Prefix

Bogon

An address or prefix that should never appear as a source on the public internet, because it is reserved, unallocated or private. Bogon filtering is cheap, carries no false-positive risk, and removes a category of forged traffic before anything expensive inspects it.See also: Spoofing, uRPF

BooterStresser · DDoS-for-hire

A commercial service that sells attack traffic, usually presented as a stress-testing tool for one's own infrastructure. Their existence is why small attacks against individual targets are common and why the attacker in many incidents is not a sophisticated actor.See also: Botnet, DDoS

Bits per secondbps · Gbps

The rate at which data crosses a link. It is how circuits are sold and the least useful unit for sizing a mitigation device, because the same bit rate carries roughly eighteen times more packets at minimum frame size than at maximum.See also: PPS, Frame size

Burst

An allowance above a rate limit, letting short spikes through without triggering enforcement. Sizing it is a trade: too small and normal traffic is refused at every momentary peak, too large and an attacker can operate inside the allowance indefinitely.See also: Rate limit, Threshold

Rate limit

A ceiling on how much a source, destination or service may send or receive in a period. It is stateless, cheap and predictable, and its quality depends entirely on whether the ceiling was derived from measured legitimate traffic or copied from a default.See also: Burst, Threshold

Challenge-response

A mechanism that asks a client to prove it is real before its request is served — by completing a redirect, storing a cookie, or executing script. It works until the attacker uses real clients, and it adds a round trip that latency-sensitive paths may not afford.See also: Application-layer attack, Latency

Carrier-grade NATCGNAT · Large-scale NAT

Address translation that places many subscribers behind one public address. It is the commonest cause of false positives in per-source rate limiting, because the busiest legitimate source on most networks is a shared address rather than an attacker.See also: False positive, Rate limit

CIDR

The notation for an address block and its mask, written as an address followed by a prefix length. Nearly every filtering, blocking and routing decision in this field is expressed in it, and a mistake of one bit doubles or halves what a rule affects.See also: Prefix, Blackhole

Concurrent sessions

How many conversations a stateful device can hold at once. It is the larger and more flattering of the two session figures, and it says nothing about how fast new entries can be created — which is what a connection-exhaustion attack actually stresses.See also: New sessions per second, Session table

New sessions per secondConnections per second · CPS

How quickly a device can establish new session-table entries. It is the figure that decides whether a SYN flood succeeds, it is rarely printed beside the concurrent-session number, and most organisations have never measured their own.See also: Concurrent sessions, SYN flood

Connection trackingconntrack

The kernel facility that records the state of each connection passing through a host, so that later packets can be matched to it. Its table is finite, its exhaustion is a common failure under flood, and the message announcing that failure appears in the system log rather than on any dashboard.See also: State exhaustion, Session table

DNS amplification

Reflection using open DNS resolvers, where a small query produces a much larger answer directed at a forged source. It remains one of the most productive amplification vectors because the protocol answers generously and open resolvers persist.See also: Amplification, Reflection

DNS water tortureRandom subdomain attack · Pseudo-random subdomain

Queries for random non-existent subdomains of a real domain, which caching resolvers cannot answer from cache and must forward. It exhausts the authoritative server and the intermediate resolvers alike, which makes bystanders part of the damage.See also: NXDOMAIN, DNS amplification

Equal-cost multi-pathECMP

Spreading traffic across several equal-cost routes. It distributes load usefully and it also means a single flow's packets may arrive by different paths, which complicates any device that assumes it sees a whole conversation.See also: Anycast, Elephant flow

Egress filtering

Filtering traffic leaving your network, principally to stop forged source addresses from escaping. It protects other people rather than you, which is why it is under-deployed and why the spoofing that makes reflection possible remains widely available.See also: Spoofing, uRPF

Fail-open

Behaviour in which a device that has failed allows traffic to pass rather than blocking it. For an inline mitigation device this is usually the desired failure mode, and whether it applies to power loss, software fault or both is a question with a factual answer that is rarely on a datasheet.See also: Fail-closed, Hardware bypass

Fail-closed

Behaviour in which a failed device blocks traffic rather than passing it. Correct for a control whose job is to prevent something, and wrong for an availability control, where it converts a component failure into the outage the component existed to prevent.See also: Fail-open, Fail-operational

Fail-operational

Continuing to perform a function in degraded form after losing something it depends on, rather than stopping safely. It is the property to specify for a DDoS defence, because the defence is needed precisely when conditions are abnormal.See also: Fail-closed, Grace period

Grace period

How long a device keeps working after it can no longer validate a licence or reach a supplier service. It runs on a timer, which means a short disconnection test passes regardless of its length — the duration of the test is the test.See also: Fail-operational

False negative

Attack traffic that the defence allowed through. It is visible: the service degrades and alarms fire. Its counterpart, the false positive, is nearly invisible from inside, which is why reports are dominated by one of the two errors.See also: False positive

Fragmentation attack

Traffic built from IP fragments that are malformed, overlapping, or never completed, so that the receiver holds reassembly state for packets that will never arrive. It exhausts memory rather than bandwidth and is invisible to anything counting only bit rate.See also: State exhaustion, Teardrop

Teardrop

A fragmentation attack using overlapping fragment offsets, historically able to crash reassembly code outright. Modern stacks handle it, and it survives as a category of malformed traffic that a defence should drop without hesitation because it has no legitimate counterpart.See also: Fragmentation attack, LAND attack

LAND attack

A packet whose source address and port equal its destination address and port, causing naive stacks to reply to themselves. Like other impossible packets, it is safe to drop by signature at no false-positive risk.See also: Spoofing, Teardrop

Frame size

The length of an Ethernet frame, from 64 bytes to 1518 for standard frames. It is the qualifier that makes a capacity figure meaningful, because the packet rate a circuit carries changes roughly eighteenfold across that range.See also: PPS, Bits per second

Geographic blocking

Refusing traffic by the country associated with its source address. It is fast and blunt, it refuses real users along with attackers, and it is unavailable to services that cannot turn away a population — which includes most public ones.See also: Autonomous System Number, False positive

Half-open connection

A TCP connection where the handshake has begun and not completed, so the receiver is holding state for a client that may not exist. Accumulating these is the entire mechanism of a SYN flood.See also: SYN flood, SYN cookie

SYN cookie

A technique that encodes connection state into the sequence number of the reply, so no memory is allocated until the client proves it exists by returning it. It removes the SYN flood's asymmetry at the cost of some TCP options and a little computation per packet.See also: Half-open connection, SYN proxy

Hardware bypass

A physical relay that connects an inline device's ports to each other when it loses power, so traffic continues to flow past a failed unit. It covers power loss well and software faults less reliably, and its failover time is a number worth measuring rather than reading.See also: Fail-open, Inline

HTTP flood

A flood of well-formed HTTP requests, often aimed at the most expensive endpoint a service exposes. Volume at the network layer may be unremarkable while the backend is saturated, which is why bandwidth monitoring misses it.See also: Application-layer attack, Goodput

ICMP flood

A flood of ICMP messages, historically ping. It is easy to generate, easy to rate-limit, and worth limiting rather than blocking outright, because path MTU discovery and several diagnostics depend on ICMP working.See also: Rate limit, Smurf attack

Smurf attack

Reflection using ICMP echo requests sent to a broadcast address with a forged source, so that every host on the segment replies to the victim. Directed broadcast is disabled by default on modern equipment, which is why the technique is now largely historical.See also: ICMP flood, Reflection

Idle timeout

How long a device keeps a session entry with no traffic on it. Shortening it frees table space under attack and breaks long-lived legitimate sessions, which makes it one of the most consequential single settings on any stateful device.See also: Session table, Connection tracking

IPFIX

The standard format for exporting flow records — summaries of who talked to whom, how much and for how long. Most out-of-path detection is computed from it, and its sampling rate sets a floor on what can be detected at all.See also: NetFlow, Flow telemetry

NetFlow

The flow-export mechanism that preceded and informed IPFIX, still widely deployed. For DDoS purposes the two are used the same way: they show volumes and distributions in detail and packet content not at all.See also: IPFIX, sFlow

sFlow

A packet-sampling export mechanism, distinct from flow-record export in that it samples packets rather than summarising conversations. Its sampling rate is the trade between visibility and overhead, and it is the number to ask about before trusting a detection claim built on it.See also: IPFIX, NetFlow

Jitter

Variation in latency between packets. For real-time traffic it is worse than latency itself: a consistent delay can be compensated for, and an inconsistent one cannot, which is why gaming and voice estates specify a jitter bound rather than only an average.See also: Latency

Latency

The delay a packet experiences in transit. In DDoS work the figure that matters is the delay added while mitigation is active at substantial load, not the one measured on an idle device, and the two can differ considerably.See also: Jitter, Time to mitigate

Line rate

Processing traffic as fast as the interface can deliver it, with no loss. The claim is meaningless without a frame size, because line rate at 1518 bytes is a fraction of the work of line rate at 64.See also: Frame size, PPS

Low and slow

An attack that uses very little bandwidth and holds resources for a long time, such as opening many connections and sending headers a byte at a time. It defeats any threshold watching volume, because there is almost none to watch.See also: Slowloris, State exhaustion

Slowloris

A low-and-slow technique that opens many HTTP connections and keeps each one incomplete, exhausting a server's concurrency limit. It is defeated by a timeout on incomplete requests, which many default configurations do not set.See also: Low and slow, Idle timeout

Memcached amplification

Reflection using exposed memcached instances, which historically produced some of the largest amplification factors observed because a small request could return a large stored value. The correct fix is not exposing memcached to the internet at all.See also: Amplification, Reflection

NTP amplification

Reflection using NTP servers, classically via the monlist command, which returned a long list of recent clients in response to a short query. Modern configurations disable it, and unpatched servers persist.See also: Amplification, Reflection

SSDP amplification

Reflection using the discovery protocol built into consumer network devices, which answer search requests with device descriptions. Its reflector population is large because the devices are consumer equipment that nobody administers.See also: Amplification, Reflection

Time to mitigate

The interval from the first attack packet to the point where impact is measurably reduced and stays reduced. Measured from the alert rather than from the attack, it flatters the product by hiding the detection interval entirely.See also: Time to detect, Latency

Time to detect

The interval from the first attack packet to the first alert a human sees. Reconstructing the true start from captures afterwards is the only way to measure it honestly, because the detecting system's own clock starts when it noticed.See also: Time to mitigate

Monitor modeLog-only mode

Running a protection so that it reports what it would have done without doing it. It is the correct first posture for any new countermeasure, and the period spent in it is what produces thresholds derived from your traffic rather than from a default.See also: Threshold, Baseline

Threshold

A limit whose crossing triggers an alarm or an action. Its quality is entirely a function of where it came from: derived from a measured legitimate peak across a full business cycle, or copied from a supplier default and left there.See also: Baseline, Monitor mode

NXDOMAIN

The DNS response meaning that a queried name does not exist. A rising proportion of them is the characteristic signal of a random-subdomain attack, which is why the ratio rather than the raw query count is the thing to watch.See also: DNS water torture

Packet capturePCAP

Recording packets in full for later analysis. It is the only evidence that settles what actually arrived, it fills disks quickly at attack rates, and the decision about what to capture selectively belongs before the incident rather than during it.See also: Flow telemetry, IPFIX

Peering

An arrangement in which two networks exchange traffic directly rather than through a transit provider. It affects DDoS exposure because it changes which paths traffic arrives by, and therefore which upstream party can filter it.See also: Transit, Upstream

Transit

A commercial arrangement in which a provider carries your traffic to the rest of the internet. The transit provider is the party with capacity above your circuit, which makes them the first call in any volumetric event.See also: Peering, Upstream, Uplink

Upstream

Anything closer to the internet than you are — a transit provider, a scrubbing service, an exchange. Volumetric attacks are won or lost upstream, because traffic above your circuit is discarded before it reaches anything you own.See also: Transit, Uplink

Uplink

The circuit connecting your network to a provider, and the hard ceiling on any attack that can reach your equipment. Sizing a mitigation device above it buys capacity for traffic that cannot arrive.See also: Transit, Upstream

Ping of death

An oversized or malformed fragmented ICMP packet that historically crashed reassembly code. Like teardrop, it survives as a category of impossible traffic that a defence should discard on sight.See also: Fragmentation attack, ICMP flood

Prefix

A block of addresses announced as a unit in routing. Most upstream countermeasures operate on prefixes rather than individual addresses, which is why the smallest thing you can blackhole is usually larger than the thing under attack.See also: CIDR, Blackhole, RTBH

Pulse attackBurst attack · Hit-and-run

Short repeated bursts, each ending before a detection-and-diversion loop closes. It exists specifically to exploit the window in on-demand architectures, and it can deny service continuously while a diversion-based defence never fully engages.See also: On-demand mitigation, Diversion, Time to mitigate

QUIC

A transport protocol running over UDP that carries much modern web traffic. It matters here because it has no TCP handshake to validate, so defences written around SYN behaviour do not apply and rate and behaviour analysis have to do the work instead.See also: UDP flood, SYN cookie

Reflector

A third-party server that answers a forged request, sending its response to the victim. It is not compromised and is usually a correctly configured service doing exactly what the protocol says, which is why reflection is difficult to eliminate at the source.See also: Reflection, Amplification

Resolver

A DNS server that answers queries on behalf of clients, caching what it learns. Resolvers appear in this field twice: as reflectors when open to the internet, and as bystanders damaged by random-subdomain attacks against somebody else's domain.See also: DNS amplification, DNS water torture

Retry storm

Synchronised reconnection attempts by many clients after an interruption. It resembles an attack closely enough that a defence can prolong an outage it did not cause, which is why recovery behaviour is measured separately from mitigation behaviour.See also: False positive, Time to recover

Time to recover

The interval from the end of an attack to the return of normal service metrics. Late clearing state, expiring blocks and retry storms all live here, and an evaluation that stops measuring when the attack stops never sees any of them.See also: Retry storm

Session tableState table · Connection table

The memory a stateful device uses to record active conversations. Its size is a headline figure, its behaviour when full — refuse, overwrite, or pass — is a design decision that varies by product and is rarely documented.See also: Concurrent sessions, State exhaustion

Signature

A pattern known to indicate hostile traffic, matched directly. It is precise and cannot see anything it has not been told about, which is why signature detection sits at the bottom of the stack where structure is rigid.See also: Behavioural detection, Threshold

Behavioural detection

Deciding that traffic is hostile because it departs from a learned model of normal, rather than because it matches a known pattern. It can catch novel vectors and it inherits whatever was wrong with the traffic it learned from.See also: Baseline, Signature

SYN flood

A flood of TCP connection requests, usually with forged sources, that fills the target's half-open connection table. It is the canonical asymmetric attack: one cheap packet from the sender, one memory allocation held for seconds by the receiver.See also: Half-open connection, SYN cookie, SYN proxy

TCP handshake

The three-message exchange that establishes a TCP connection. Almost every transport-layer defence works by refusing to allocate memory until the exchange completes, which is what makes the handshake the natural place to put a defence.See also: SYN cookie, Half-open connection

UDP flood

A flood of UDP packets, which require no handshake and therefore no cooperation from the target. Sources may be forged or genuine, and the difference matters because it decides whether source-based countermeasures will work.See also: QUIC, Spoofing

Volumetric attack

An attack whose objective is to fill the circuit. It is decided upstream of you, because traffic beyond your uplink is discarded before arriving, and no equipment on your premises changes that.See also: Uplink, Upstream, Amplification

ZombieBot

A compromised host participating in an attack without its owner's knowledge. The term matters operationally because zombie traffic comes from real addresses with real users behind them, so blocking the source has a cost.See also: Botnet, Geographic blocking

This guide is updated as vendors release new models and pricing. How we compare vendors