Why traditional DDoS protection is not enough. Network capacity decides, not firewall complexity

If a service cannot be protected from a DDoS attack, the consequences quickly spill over into how the company operates. For large enterprises an outage can mean reputational damage, a breach of contractually guaranteed service availability and demanding operational incident handling. For fast-growing technology companies it shows immediately in lost revenue, higher operating costs and pressure on a team that, instead of developing the product, is dealing with service availability.

DDoS attacks are becoming an ever bigger challenge. Cloudflare reports that in 2025 it mitigated 47.1 million DDoS attacks, 121 % more than a year earlier. In the third quarter alone there were 8.3 million attacks, roughly 3,780 per hour.

Data from the Cloudflare network shows that in 2025 traffic stopped because of DDoS attacks or web application security rules made up roughly 3.3 % of all traffic.

Many organisations nevertheless imagine that protection is a matter of a stronger firewall or stricter security rules.

⇢ Attacks today are massively automated and easy to scale. Cloudflare reports that almost 30 % of global bot traffic comes from large cloud platforms, which let attackers cheaply and quickly deploy thousands of traffic-generating instances.

⇢ Most attacks are short and often end before a human or an on-demand service could intervene. Roughly 89 % of network-layer DDoS attacks and 71 % of HTTP attacks end within 10 minutes.

⇢ Even if an attack lasts only minutes or seconds, the subsequent restoration of services, data consistency checks, restarting application dependencies and stabilising operations can take much longer.

⇢ Protection therefore has to be always on, automatic and large enough to absorb the attack and the legitimate traffic at the same time.

A more expensive firewall does not automatically mean more DDoS protection

A firewall is an important part of the security architecture, but in volumetric DDoS attacks it solves a different kind of problem. While ordinary security incidents are handled by analysing packets and connections, a volumetric DDoS attack hits the transmission capacity of the network itself.

That is why even a very powerful enterprise firewall is not enough on its own as DDoS protection. The technical specifications of common enterprise appliances show firewall throughput in the order of tens of gigabits per second. For example, the Cisco platform quotes roughly 55-70 Gbps of firewall throughput depending on configuration. Those are high figures for normal data centre traffic, but still several orders of magnitude smaller than the volume of modern DDoS attacks. Cloudflare, for instance, recorded attacks of 29.7 Tbps and later 31.4 Tbps in 2025, that is roughly 29,700 to 31,400 Gbps.

Specialised security analyses point to the same problem. NSFOCUS, which has long researched DDoS attacks and developed their mitigation, states that firewalls and IPS were not designed to defend against high-volume attacks. They work mainly on the principle of static rules and tracking individual connections, which at high traffic volumes can turn them into the bottleneck of the infrastructure.

FastNetMon, an open-source system for detecting and mitigating DDoS attacks used by network operators, reaches a similar conclusion. It warns that a firewall should not be used as the main defence against DDoS attacks, because at high traffic volumes it simply cannot process all the requests.

What happens when an attack fills the network's capacity

In volumetric DDoS attacks the key concept is bandwidth saturation, that is filling up the transmission capacity of the network. Every internet line has a limited bandwidth, the maximum amount of data it can carry per second. If an attacker sends more data than the line can handle, legitimate traffic starts being dropped. It is not a fault of the server or the firewall. The data simply does not get through.

In this case you can compare the network to a pipe. If more water starts flowing through it than its diameter allows, the flow blocks. A volumetric DDoS attack works the same way: the attacker fills the transmission capacity of the network with so much traffic that legitimate requests never reach the service at all.

In practice two different metrics are tracked. Bits per second (bps) express the volume of data passing through the network. Packets per second (pps) show the number of individual packets the network devices have to process. An attack either fills the line with a large volume of data or overwhelms the infrastructure with an enormous number of packets, even if the individual packets are small. Cloudflare has recorded not only attacks above 1 Tbps but also attacks above 1 billion packets per second. In 2025 it even observed record attacks of 31.4 Tbps and 14.1 Bpps.

Why on-premise protection fails: geography and time

Modern DDoS attacks are not a local event. The traffic does not come from one place but from thousands to millions of devices scattered around the world. The record 7.3 Tbps attack that Cloudflare described in 2025 came from more than 122,000 source IP addresses, 5,433 autonomous systems and 161 countries. That means the defence has to be geographically distributed; the attack cannot be stopped from a single point of the infrastructure.

The second limit is time. According to Cloudflare data, roughly 89 % of network-layer DDoS attacks and 71 % of HTTP DDoS attacks end within ten minutes. Some record attacks lasted only 35 to 45 seconds. One of them, for example, delivered 37.4 TB of data in just 45 seconds. By the time the incident shows up in monitoring, someone assesses it and approves an intervention, the attack may be long over.

What should a working defence model look like?

A local security appliance in the data centre cannot stop traffic that has already filled the organisation's internet line. The defence therefore has to work before the attack traffic reaches the victim's infrastructure.

This principle is called traffic scrubbing. Traffic is first routed into a large distributed network, where it is analysed and the malicious part separated. Only legitimate traffic then continues to the organisation's servers. Control over security is not lost; it merely moves from the level of manual intervention on individual appliances to the level of rules, automation and continuous measurement.

A routing method called anycast plays a key role here. The network operator announces the same IP address from many data centres around the world, so the internet automatically routes traffic to the nearest available point of the network. Attack traffic is thus dispersed across many locations and thousands of servers instead of hitting one corporate line or one data centre. To illustrate the scale of the infrastructure: Cloudflare today quotes a global network capacity of roughly 477 Tbps across hundreds of data centres. Such distributed capacity makes it possible to absorb attacks that would instantly saturate a single corporate line or a single data centre.

It is exactly this principle that makes it possible to absorb even extremely large attacks. Cloudflare, for example, describes a 7.3 Tbps attack that was mitigated across hundreds of data centres in more than a hundred locations around the world.

Adequate protection should in practice have these properties:

• Sufficient global capacity. The point is not merely to "survive" the attack but to absorb its volume so that legitimate user traffic can keep flowing alongside it.
• Geographically distributed infrastructure. More points in the network make it possible to spread the attack across many locations and prevent it from concentrating on a single place.
• Automatic mitigation in real time. Most attacks are too short to wait for a manual intervention by an operator or the activation of an external service.
• Measurability and transparency. The organisation must see how much traffic was stopped, which types of attacks were used and how the system responded.
• The ability to handle combined attacks. Modern campaigns often mix several techniques at once, from flooding the network through exhausting connections to attacks on the application layer. The defence therefore has to cope not only with a large volume of data but also with an extreme number of packets per second and attempts to exhaust the resources of devices.

NoName057(16) and DDoS as a tool of pressure

In its report on the state of cybersecurity in the Czech Republic for 2024, NÚKIB states that it recorded 268 incidents, a significant share of them DDoS attacks. Most of these attacks were carried out by Russian-speaking hacktivist groups, in particular NoName057(16). According to the agency, these activities generally did not cause damage beyond short-term outages of the attacked websites, but that is precisely why DDoS attacks are sometimes underestimated. They are not always devastating in terms of data loss, as ransomware is, but they very effectively disrupt the availability of services.

In January 2026 NÚKIB recorded 32 incidents, the highest figure in the past 12 months, almost half of them a wave of DDoS attacks attributed primarily to pro-Russian hacktivist groups. In February 2026 the number of incidents fell to 23, but it was still above average. DDoS therefore remains a relevant tool of pressure on public institutions and private organisations in the Czech environment too.

Another "box" will not solve the capacity problem

DDoS defence is moving towards an architecture that can catch and filter an attack before it hits the organisation's infrastructure. An example of this approach is the model used by Cloudflare. It is based on a global network of data centres, anycast routing and automatic detection and mitigation of traffic directly in the network infrastructure. Attack traffic is spread across hundreds of locations, behaviour patterns are evaluated in real time and malicious traffic is blocked before it reaches the customer's infrastructure.

It is precisely this shift from protection in the data centre to protection at the level of the internet that today determines whether an infrastructure can truly withstand modern DDoS attacks.