Layer 3, Layer 4 and Layer 7 DDoS Protection

The layer an attack operates at is not a taxonomy convenience. It determines which device can even see the attack, which countermeasure can act on it, and — most usefully — whose problem it is.

Getting this wrong is expensive in a specific way: organisations buy capacity for a layer they are not being attacked at, and remain exposed at the layer where they are.

At a glance

Appliance	Layer	Resource attacked	Where it is won
L3 — network	Circuit capacity and router forwarding	Upstream of your circuit, always
L4 — transport	Connection state, session tables, listen queues	At the edge, by refusing to allocate memory
L7 — application	CPU, database, backend work per request	In the application's own terms, or not at all

The third column is the practical one. It says where the fight happens, which is also where the money has to be spent, and the three answers are in three different places.

Layer 3: the fight you do not have

Network-layer attacks aim at capacity. Enough traffic arrives that the circuit fills, and once it is full the discard happens at your provider’s edge, not at yours.

The consequence is uncomfortable and worth stating plainly: no equipment you own can win a Layer 3 attack larger than your circuit. An appliance behind a saturated link is a bystander. Whether it is rated for 20 Gbps or 200 makes no difference above the line.

Two families dominate. Direct floods send volume from many hosts. Reflection and amplification sends small forged requests to third-party services that answer to your address with much larger replies — the amplification factors are documented in the amplification dataset and are the reason a modest botnet can produce enormous volume.

What actually works: ingress filtering at the edges of the internet reduces the spoofing these attacks depend on; upstream filtering via FlowSpec or RTBH discards traffic where there is still room; and scrubbing diverts it somewhere with more capacity. All three happen above your circuit, which is the point.

Layer 4: the fight you can win at the edge

Transport-layer attacks aim at state rather than capacity. A SYN flood does not need to fill your pipe; it needs to fill your connection tables, and those are much smaller.

The asymmetry is the whole mechanism. A forged SYN costs the sender one packet and nothing else. It costs the receiver a table entry, held for seconds, plus a response. RFC 4987 laid this out decades ago and nothing has changed since.

This is the layer where a defence can genuinely win, because the countermeasure removes the asymmetry rather than out-spending it. SYN proxy and SYN cookies complete the handshake without allocating per-connection memory, so the attacker’s cheap packet becomes cheap for you too. Whatever survives is a client that demonstrably exists.

The ordering principle behind that is the subject of stateful and stateless defence: do the fixed-cost work first, and allocate memory only for what survives it.

Connection-exhaustion variants stress the same resource more slowly. Slowloris and slow HTTP hold connections open rather than opening them rapidly, and defeat any threshold watching bandwidth, because there is barely any.

Layer 7: the fight that is about your application

Application-layer attacks send requests that are entirely well-formed. The packets are valid, the TCP conversations complete, the HTTP is correct. What makes them hostile is the cost ratio: a request that takes the client a microsecond to send takes your server a database query, a template render and a cache miss to answer.

Nothing at the packet layer distinguishes these from popularity. A search request that scans a large table looks identical to a legitimate search. This is why L7 defence needs to know something the network does not: session behaviour over time, client characteristics, or the application’s own semantics.

The practical countermeasures reflect that. Rate limits per source work until sources are distributed. Challenges — proving the client is a real browser — work until the attacker uses real browsers. Behavioural analysis of session shape works and needs to have learned your application first. And the most reliable measure is not a security product at all: making the expensive request cheaper, through caching, query limits and pagination.

HTTP floods and DNS water torture are the two most instructive examples, the second because it exhausts a resolver through a cache that structurally cannot help.

Why the layers do not substitute

Three failure patterns, each common:

Buying capacity against an L7 attack. More bandwidth and a larger appliance change nothing when the requests are legitimate in form and few in number. The bottleneck is a database.

Relying on an application-layer control against L3. A WAF or CDN edge that must terminate connections is itself a resource, and volume large enough to saturate the path in front of it never reaches its logic.

Assuming the firewall covers L4. It covers policy at L4. Under a flood it is the resource being attacked, for the reasons above and in firewall, IPS, WAF or DDoS appliance.

Mapping your own exposure

An afternoon’s work, and it changes procurement more than any vendor conversation:

1. List what is reachable from the internet, with its circuit and its purpose.
2. For each, ask what fails first. Is it the circuit, the connection table on some device in the path, or the application backend? One of the three is nearly always obviously closest.
3. For each answer, name the owner. Circuit means the upstream provider or a scrubbing arrangement. Connection table means the edge device and its sizing. Application backend means the engineering team, and often a caching change rather than a purchase.
4. Record what you cannot currently see. An estate with no flow export cannot detect L3 patterns; one with no application logging cannot detect L7 ones. Visibility gaps are the cheapest thing on this list to fix and the most commonly skipped.

The output is a one-page table that tells you which of the three fights you are actually in. Most organisations discover they have been buying for one layer and exposed at another, and the sizing exercise becomes much shorter once this is written down.