How Network-Level DDoS Mitigation Works

Network-level DDoS protection stops attack traffic before it reaches your internet connection. It typically involves three stages: detection, diversion and scrubbing.

Detection

The provider monitors traffic flowing to protected IP addresses, building a baseline of normal patterns. When traffic deviates sharply — a sudden flood of packets, unusual protocols or a spike from many sources — detection systems raise an alert.

Diversion

Once an attack is detected, traffic destined for the target is redirected to mitigation infrastructure, often called scrubbing centres. This can happen automatically within minutes.

Scrubbing

Scrubbing systems analyse traffic and filter out malicious packets using techniques such as rate limiting, signature matching, protocol validation and reputation filtering. Clean traffic is forwarded to your connection.

Return to normal

When the attack subsides, traffic routing returns to normal. Some services keep heightened monitoring for a period afterwards.

Always-on vs on-demand

• Always-on: traffic is continuously filtered, offering instant protection with minimal delay.
• On-demand: traffic is diverted only during attacks, with a short detection window.

Capacity matters

Mitigation infrastructure must have more capacity than the largest expected attacks. Providers aggregate capacity across their network.

Reporting

After an attack, you should receive reports showing attack size, type, duration and actions taken.

Working with your provider

Share information about critical services and normal traffic patterns so detection is accurate.

The bottom line

Network-level mitigation protects your connection from attacks too large to handle on site. UbiFi DDoS Business Protect provides detection and scrubbing for business links.

Learn more about DDoS Business Protect from UbiFi, or talk to our team.