Techniques
Mitigation techniques
A technique is only useful once you know which failure it answers. Blackholing certainly works and takes the destination down with it; a rate limit is available everywhere and is the control most likely to cause the outage it was meant to prevent; anycast disperses volume and filters nothing. None of that is criticism — it is the shape of each tool, and choosing well means knowing the shape.
Every page here follows the same six questions: how it works, what it works against, what it does not, the operational risk, the false-positive risk, and how to verify it outside an incident. The last one matters most, because almost every failure in this field turns out to be a control that nobody had exercised.
Where a technique corresponds to a published standard, the standard is cited rather than paraphrased — the RFCs behind these pages are collected in the standards dataset.
Start here
All techniques
Technical deep dive · Last updated August 2026
Behavioural, Threshold and Signature Detection Compared
Three ways to decide that traffic is hostile, each with a failure mode the others do not have. What each catches, what each misses, why every serious product uses all three, and which questions separate a good implementation from a marketing claim.
Mitigation technique · Last updated August 2026
Anycast for DDoS Mitigation
Anycast spreads an attack across every site announcing the prefix, turning one saturated location into many partially loaded ones. What that buys, why it does nothing about application-layer attacks, and the operational constraints it introduces.
Mitigation technique · Last updated August 2026
Ingress Filtering: BCP 38, BCP 84 and uRPF
Ingress filtering stops forged source addresses leaving a network, which is what makes reflection attacks possible. Why a control that has been standard practice since 2000 is still unevenly deployed, and what strict uRPF breaks on multihomed networks.
Mitigation technique · Last updated August 2026
Behavioural Baselining and ML Detection
Learned baselines let a defence act on a pattern nobody has named yet. What the learning window, drift, sparse traffic and encryption actually cost — written without the claim that machine learning detects zero-day attacks automatically.
Mitigation technique · Last updated August 2026
DOTS: DDoS Open Threat Signaling
DOTS defines how an entity under attack asks an upstream mitigator for help without a vendor-specific integration. The signal channel, the data channel, what the standard settles — and the adoption caveat that decides whether you can build on it.
Mitigation technique · Last updated August 2026
Rate Limiting for DDoS Defence
Rate limiting is the most available DDoS control and the easiest to turn into a self-inflicted outage. Which dimension to limit, why per-source limits fail against distributed attacks, and how to set a threshold you can defend at a business peak.
Mitigation technique · Last updated August 2026
SYN Proxy and SYN Cookies
Both defend the half-open connection table against SYN floods, and they make different trades. How each works, what each costs in TCP fidelity and state, and how to tell which one a product is actually doing.