Thin Transit: DDoS Resilience Where International Capacity Arrives Through a Few Cable Systems

This guide argues against the recommendation this site usually makes, in one specific set of conditions. That is deliberate. A comparison in which the house answer is never tested is not a comparison, and the conditions in question describe a good part of the Gulf.

The house answer is an on-premise-first hybrid: an inline appliance handling everyday traffic in country, with an upstream tier engaged for volumes larger than your own circuit can carry. The reasoning is sound and is set out in full in the architecture comparison. But it rests on two assumptions that go unstated because in most markets they are simply true: that the upstream tier is reachable over paths with capacity to spare, and that the clean traffic comes back without difficulty.

In a market where international capacity arrives through a handful of submarine cable systems and is sold by a handful of licensed carriers, both assumptions get weaker at exactly the moment you need them.

The diversion puts load on the constrained resource

Start with what diversion actually does to a path.

Before diversion, your international circuits carry legitimate inbound traffic plus whatever attack volume is arriving from outside. After diversion, they carry the clean traffic returned from the scrubbing centre — encapsulated, with tunnel overhead, over a route the provider selects rather than the one ordinary routing would choose, and often with a less direct physical path than your normal transit.

The attack traffic is gone, which is the entire point and is a real gain. But the relief is not free in the way the diagram implies, because the thing you have relieved and the thing you have loaded are the same scarce resource. In a market with abundant, diverse international capacity the second-order cost disappears into the noise. In a market where international capacity is the binding constraint on everything, it does not.

The return path is a single logical dependency

The second assumption is quieter and more consequential.

A diversion arrangement has two halves: getting the attack traffic to the scrubbing tier, and getting the clean traffic home. The second half is a tunnel — one logical construct, terminating on your equipment, carrying everything your users need. Its resilience is usually described in terms of the provider’s network, which is genuinely large and genuinely well engineered.

The failure mode that matters is not the provider’s network breaking. It is correlation.

During a national-scale event — a campaign against a country’s financial sector, a regional hacktivist wave, a period of heightened tension — a large number of organisations in the same market divert at the same time. The tunnels come home across the same small set of physical systems. The scrubbing capacity being drawn on is regional and shared. And every peer who made the same architectural choice as you is now competing for the same constrained return path, at the same moment, for the same reason.

A hybrid design is safe because its two tiers fail independently. Thin transit is precisely the condition under which that independence is weakest, and it is weakest during exactly the event the second tier was bought for.

“Multi-homed” is a commercial statement, not a physical one

Ask a network team whether the organisation is multi-homed and the answer is yes. Ask which physical cable systems the two upstreams depend on, and the answer is usually that nobody has asked.

This is not negligence. Carriers do not volunteer the information, resilience is sold on commercial diversity because that is what is contractible, and the diagram genuinely shows two providers. But in a market with few licensed carriers and few landing points, two commercially independent contracts frequently rest on overlapping infrastructure — and a shared physical dependency defeats the redundancy without ever appearing in the design document.

The question belongs in the tender, phrased so that a vague answer is visible as a vague answer: which physical cable systems and landing stations does the capacity you are selling us depend on, and what is the path when a named one of them is unavailable? Providers that have a good answer will give it. Providers that do not will produce a description of their network’s total size, which is itself the answer.

The consequence: the local tier is load-bearing

Put the three observations together and the weighting shifts.

If diversion is more expensive than the diagram suggests, if the return path is more correlated than assumed, and if the diversity underneath both is thinner than the contracts imply, then the tier that does not depend on any of it has to carry more.

That does not mean abandoning the upstream tier. Above your own circuit capacity there is nothing else, and a terabit-scale flood is a terabit-scale flood in Doha as anywhere. It means three concrete changes to how the local tier is specified and operated:

Size it against your real peak, not a template. The relevant number is your genuine domestic peak plus the attack volume your own circuit can physically deliver — not a figure copied from a guide written for a market with different economics.

Design so that domestic users are unaffected by a border event. This is the recommendation with the largest return and the least attention. If a substantial fraction of your legitimate traffic never leaves the country, then placing the inspection point inside means those users keep working through an international-path event that takes out everything crossing the border. That is a property of where the appliance sits, not of how much capacity you bought.

Treat diversion as an exception with a rehearsed procedure, rather than as the plan with a local pre-filter. The distinction shows up in the runbook: whether the local tier is expected to hold, or expected to buy time.

Measure the domestic fraction before designing anything

Almost every team guesses this number, and almost every guess is low. The mental model of the internet is international; the traffic of a national bank, a government portal, a domestic retailer or a local media property frequently is not.

Take a normal week of flow records at the border and split by whether the far end is inside the country. Do it before the architecture discussion, because the number changes which discussion you are having. A service where four fifths of legitimate traffic is domestic has an available design in which four fifths of its users are structurally immune to the failure mode this whole guide is about. A service where the fraction is small does not, and should weight the upstream tier accordingly.

Appliance	Continental market	Thin-transit market
What diversion costs	Extra latency on a path with spare capacity	Extra load on the resource that is already scarce
Diversity of the path to the scrubbing tier	Many routes, many operators, low correlation	Few routes, few operators, high correlation
Behaviour during a regional event	Providers absorb independently	Everyone diverts across the same infrastructure at once
What "multi-homed" usually means	Two providers, largely separate physical paths	Two providers, possibly the same cable systems
Share of traffic that is domestic	Often small; assume international	Often large; measure it before designing
Where the local tier sits in the design	First line, upstream does the heavy lifting	Load-bearing; upstream is the exception, not the plan
The question the RFP misses	How fast is diversion	What physical systems does your diversity claim rest on

Neither column is a recommendation. They are two different sets of assumptions, and the error this guide is about is applying the left column's design to the right column's market.

What to require, in order

1. Measure the domestic fraction of legitimate traffic at the border over a full normal week.
2. Establish, in writing from each upstream, which physical cable systems and landing stations the purchased capacity rests on.
3. Size the local tier against domestic peak plus deliverable attack volume on your own circuit.
4. Specify the return path explicitly in the transit contract: encapsulation, route, capacity, and behaviour when many customers divert simultaneously.
5. Rehearse the diversion at a scheduled time, and measure decision-to-mitigation on your own network rather than accepting the provider’s figure.
6. Confirm that the local tier’s own detection does not depend on reachability of anything outside the country — a mitigation layer that degrades when an external service is unreachable has imported the exact dependency the design was built to avoid.

That last point is where the equipment choice actually bites in this market, and it is narrower than the usual sovereignty argument. The question is not where a manufacturer is based; it is whether the box in your rack keeps classifying traffic correctly when the border is the thing that is broken. Products differ here, and the difference is answerable from documentation. An appliance that trains and executes its detection on the customer’s own infrastructure turns a severed international path into a capacity problem rather than a detection problem. Appliances that consult a manufacturer-operated intelligence service should be assessed on how they degrade rather than on whether they degrade — most degrade gracefully, and the honest question for a shortlist is how far, for how long, and against which attack classes.

The honest counter-argument

Two things push the other way and deserve stating plainly.

Upstream cloud capacity and onboarding speed are genuinely hard to match on premises. A provider that can absorb a large flood today, without a procurement cycle, is offering something no appliance does, and an organisation with no local tier at all is better served by buying that today than by designing the ideal architecture for next year.

And a small number of physical paths cuts both ways. The same concentration that makes diversion correlated also means the carriers involved are large, well-resourced, and have strong incentives to keep the country’s international capacity working — often stronger than an individual enterprise’s. Thin transit is a reason to weight the local tier more heavily. It is not a reason to treat the international path as unreliable in ordinary operation, and a design premised on that would be wrong about the market in the opposite direction.

Sources and further reading

Cable system and landing station information for the region is published by the carriers and by public submarine cable registries; the authoritative answer for your own capacity, though, is the one your provider gives in writing during a tender. For the assurance and classification analysis that sits alongside this structural one, see the Qatar classification guide. For the general trade between the tiers, see the architecture comparison.