Layer 3 / Layer 4 Network DDoS Protection

Network DDoS Protection for your critical infrastructure.

Protect your network against Layer 3 and Layer 4 DDoS attacks. Route traffic through DDOS ARMOR and deliver filtered traffic to your existing infrastructure using GRE tunnels.

Request a consultation
  • Layer 3 / Layer 4
  • BGP routing
  • Clean traffic over GRE
  • No server migration
INTERNETPROTECTION ONDDOS ARMORFiltering network · L3/L4GRE tunnelClean trafficYour data centreServers stay where they arePROTECTED
  • L3 · L4Filtering at the IP, TCP and UDP layers
  • BGPTraffic routing through prefix announcements
  • GREClean traffic delivered to your infrastructure
  • In placeYour servers and data centre do not move

Architecture

Stop attack traffic before it reaches your network.

BGP routes traffic to our filtering network, GRE carries clean traffic back to you. Pick a step to highlight its link in the topology.

Return path · depends on the setup modelGRE tunnelClean trafficInternetSource trafficBGPPrefix announcementScrubbing networkDDOS ARMOR · L3/L4FirewallAttack blockedCustomer routerTunnel endpointProtected serversExisting data centreReturn path · depends on the setup modelGRE tunnelClean trafficInternetSource trafficBGPPrefix announcementScrubbing networkDDOS ARMOR · L3/L4FirewallAttack blockedCustomer routerTunnel endpointProtected serversExisting data centre

Traffic Routing

Your protected prefixes are announced over BGP from the DDOS ARMOR network. Routers on the internet send traffic for those prefixes to our filtering network.

  • BGP is the control plane: it decides which path traffic takes
  • Prefix ownership and routing records are checked before setup
  • The smallest widely accepted IPv4 announcement is usually a /24

Attack coverage

Layer 3 and Layer 4 attack matrix

Network DDoS Protection targets attacks at the IP and transport layers. Exact coverage is written in the plan record and the setup document; types written in the product record are marked on the card.

Layer 3 · Network layer

  • ICMP Flood

    Floods of ICMP echo and control messages try to exhaust link and CPU capacity. Evaluated against protocol and rate limits.

  • IP Fragmentation

    Fragments that cannot be reassembled, or overlap, exhaust reassembly resources. Fragment integrity and rate are checked.

  • Volumetric network attacks

    High-volume traffic aimed at filling your link. The aim is to absorb it on the filtering network before your link; the volume depends on plan capacity.

  • Other IP-layer attacks

    Vectors such as spoofed-source traffic and packets with invalid headers. Coverage is set during setup from your traffic profile.

    Assessed during setup

Layer 4 · Transport layer

  • UDP Flood

    Large volumes of UDP packets to random or targeted ports. Separated by port, rate and packet structure.

  • TCP SYN Flood

    Unfinished connection requests fill state tables. Half-open connections are evaluated before they reach your server.

  • TCP ACK Flood

    ACK packets that match no connection load state tracking. Packets with no matching session are separated.

  • TCP Connection Exhaustion

    Completed but idle connections exhaust connection limits. Limited by per-source connection and rate policies.

  • DNS / NTP Amplification

    Small spoofed requests make open servers send large replies to the target. Reflected traffic is separated by source port and profile.

  • Other protocol attacks

    Other UDP reflection types and protocol-specific floods. Coverage is set during setup from your services and ports.

    Assessed during setup

WAF, bot filtering and browser verification inspect HTTP requests and are not part of this service; they belong to Web DDoS Protection. Web DDoS Protection

Remote protection

Your servers stay where they are. Your protection comes from DDOS ARMOR.

Customers can use DDOS ARMOR's L3/L4 protection infrastructure through a suitable network configuration, without changing their data centre or servers.

Today

  1. Internet
  2. Your link
  3. Your servers

Attack traffic lands directly on your link.

With DDOS ARMOR

  1. Internet
  2. DDOS ARMOR
  3. GRE
  4. Your servers

Attacks stay on the filtering network; clean traffic reaches you through the tunnel.

  • Remote DDoS Protection

    Your servers stay in another data centre; filtering happens on points in the DDOS ARMOR network.

  • BGP Routing

    Eligible prefixes are announced over BGP through DDOS ARMOR, pulling incoming traffic to the filtering network.

  • GRE Tunnel Delivery

    Scrubbed traffic is delivered over a GRE tunnel to the tunnel endpoint on your router.

  • Layer 3 & Layer 4 Filtering

    Attack traffic at the IP, TCP and UDP layers is separated with protocol and behaviour rules.

  • Network Traffic Control

    Write IP, country and ASN rules in priority order to decide which traffic is accepted.

  • Existing Infrastructure Compatibility

    Infrastructure with a GRE-capable router or firewall can connect without new hardware; compatibility is checked before setup.

Plans

Network DDoS Protection plans

Choose protected bandwidth in Gbit/s; the price follows the capacity you pick and scales up to 10 Tbit/s. The order is opened by our team after a private consultation.

  • L3 · L4

    Network DDoS Protection

    Choose protected bandwidth in 10 Gbit/s blocks. Each block is $50 / month, scaling up to 10 Tbit/s.

    Protected bandwidth100 Gbit/s10 blocks × $50
    Gbit/s

    $500/ mo

    This service is provided after a private consultation. BGP and GRE configuration go live with our team once the network eligibility check is complete.

    Contact us

    Plan parameters

    Protected bandwidth
    100 Gbit/s
    Scalable capacity
    Up to 10 Tbit/s
    Price unit
    $50 / 10 Gbit/s / mo

    These parameters are set in writing during the network eligibility check:

    • IP / prefix scope
    • GRE delivery
    • BGP routing
    • Attack scope
    • Traffic policies
    • Support level
    • Setup requirements

Technical integration

Setup takes four steps

The connection model depends on your network. These steps and notes show what your network team should prepare before setup.

  1. Service and IP scope

    Protected prefixes, TCP/UDP services and ports, and your traffic profile are mapped together.

  2. Network eligibility check

    Prefix ownership, IRR and RPKI records, a letter of authorisation (LOA) where needed, GRE support on your router and the MTU layout are reviewed.

  3. BGP and GRE configuration

    The prefix announcement plan is prepared; where clean traffic delivery needs it, GRE tunnel endpoints are configured on both sides.

  4. Testing and go-live

    Once tunnel, MTU/MSS and routing tests pass, the prefix announcement is enabled and protection goes live.

Technical notes for your network team

ASN and IP prefix requirements
With your own ASN and prefix, the announcement can be made through DDOS ARMOR under your authorisation. Without an ASN or an IP block of your own this is not supported automatically; whether a suitable model exists is assessed separately.
GRE tunnel endpoint
One end of the tunnel sits on the DDOS ARMOR filtering network, the other on your router or firewall. Endpoints use fixed, reachable IP addresses, and the tunnel source address stays outside the protected prefix.
MTU and MSS
GRE adds a header to every packet. Tunnel MTU and TCP MSS are lowered to match; MSS clamping and fragmentation behaviour are tested during setup.
Return path for clean traffic
In most models your servers reply directly through your own internet uplink; in some, replies return through the tunnel. The path and source address filtering (uRPF, BCP 38) are agreed during setup.
A BGP session is not the GRE tunnel
BGP is the control plane that decides how prefixes are announced; GRE is the data plane that carries clean packets. Depending on the model, the BGP session can run inside the tunnel or over a separate link.
GRE encapsulation and MTU
Outer IP20 BGRE4 BInner IP20 BTCP20 BPayload≤ 1436 B
Overhead · 24 BTunnel MTU · 1500 − 24 = 1476 B
Overhead
20 + 4 = 24 B
Tunnel MTU
1500 − 24 = 1476 B
TCP MSS
1476 − 40 = 1436 B

Example of keyless GRE over IPv4. Actual values are verified on your link during setup.

  • Control planeBGPPrefix announcement · traffic path
  • Data planeGREEncapsulation · clean packet delivery

The right product

Web Protection or Network Protection?

The two products work at different layers and do not replace each other.

Layer 3 / Layer 4 This page

Network DDoS Protection

  • Layer 3 / Layer 4
  • TCP/UDP
  • IP and protocol based attacks
  • BGP routing
  • Clean traffic delivery over GRE tunnels
  • Servers and network infrastructure
  • Web DDoS Protection inspects HTTP requests; it does not protect game servers, DNS, VPN or your own TCP/UDP services.
  • Network DDoS Protection filters IP traffic at L3/L4; it does not evaluate HTTP request content, WAF rules or bot verification.
  • If you run a website and services on your own IP block, both can be used together.

Use cases

Who is it for?

Network DDoS Protection is built for infrastructure whose traffic must be protected at the IP and port level.

  • Hosting providers

    Protect the prefixes your customers' servers live on from one place, so an attack on one customer does not fill your whole link.

  • Data centres

    Absorb attack traffic on the filtering network before it enters your data centre, without changing your uplinks or hardware.

  • Dedicated server owners

    Receive clean traffic over a GRE tunnel for physical servers at another provider. Eligibility depends on your IP scope and your provider's network.

  • Network operators

    A protection model that fits your own ASN and prefix plan is designed together with our network team.

  • Enterprise infrastructure

    Protect non-web services such as VPN, email, voice and custom TCP/UDP applications at L3/L4.

  • Games and real-time services

    For UDP-heavy game and real-time services, aim to separate attack traffic from player traffic.

What Is Network DDoS Protection?

Network DDoS Protection stops attacks at the IP and transport layers. Layer 3 DDoS Protection targets network-layer vectors such as ICMP floods, IP fragmentation and volumetric attacks; Layer 4 DDoS Protection targets UDP floods, TCP SYN and ACK floods and amplification attacks.

Unlike web application protection, it looks at packets rather than HTTP request content. That makes L3 L4 DDoS mitigation the right fit for non-web infrastructure such as game servers, DNS, VPN and custom TCP/UDP services.

  • IP, TCP and UDP layers
  • Non-web services
  • Packet-level filtering
  • Coverage written in the plan

How BGP DDoS Protection and GRE Tunnels Work Together

With BGP DDoS protection, your prefixes are announced from the DDOS ARMOR network and internet traffic reaches our filtering network. BGP only handles routing here; it does not carry packets.

Scrubbed traffic is delivered with GRE tunnel DDoS protection, encapsulated in GRE and sent to the tunnel endpoint on your router. That is remote DDoS protection: your servers stay in your current data centre. Prefix eligibility, GRE support and MTU are checked before setup.

  • BGP: control plane
  • GRE: data plane
  • No server migration
  • Eligibility check

Choosing a Network DDoS Mitigation Service

Before you buy a network DDoS mitigation service, see the clean bandwidth, mitigation capacity, covered IPs and prefixes, GRE delivery option and support level in writing. These values vary by plan and setup model.

If you have no ASN or IP block of your own, settle which model fits at the start. Having your network team check GRE support on the router, MTU/MSS settings and the return path before setup shortens go-live.

  • Capacity in writing
  • ASN and prefix status
  • GRE and MTU fit
  • Support level

FAQ

Network DDoS Protection: Frequently Asked Questions

BGP, GRE, eligibility and buying.

A service that stops Layer 3 and Layer 4 DDoS attacks by routing traffic to the DDOS ARMOR filtering network. Attack packets are dropped on our network and clean traffic is delivered to your infrastructure.

No. With a suitable network configuration, traffic is routed to our filtering network over BGP and clean traffic is delivered to your existing data centre over a GRE tunnel. Eligibility is checked before setup.

BGP is the control plane that decides how your prefixes are announced and which path traffic takes. GRE is the data plane that encapsulates clean packets and carries them to your router. A BGP session is not the GRE tunnel itself.

That is not supported automatically. Whether a suitable model exists depends on your IP scope and your current provider's network and is assessed separately. Talk to our sales team about your case.

Price follows protected bandwidth: each 10 Gbit/s block is 50 USD a month. Pick any capacity between 10 Gbit/s and 10 Tbit/s; yearly billing is 10% less.

The service targets L3/L4 vectors such as ICMP floods, IP fragmentation, volumetric attacks, UDP floods, TCP SYN/ACK floods, connection exhaustion and DNS/NTP amplification. Exact coverage and capacity are written in the plan record and the setup document.

For a website that only runs over HTTP/HTTPS, Web DDoS Protection fits. For TCP/UDP services, game servers or network infrastructure on your own IP block, you need Network DDoS Protection. Both can be used together.

After payment the service opens in your customer panel. BGP and GRE configuration and traffic tests are completed with our team after the network eligibility check. The timing depends on your network.

GRE adds a header to every packet, so tunnel MTU and TCP MSS are usually lowered. The right values and MSS clamping are agreed during setup tests.

Get your network ready for L3/L4 attacks

This service is provided after a private consultation. Share your network layout and we bring protection live together after the eligibility check.

Contact us