Complete guide, 2026
How does DDoS protection work? And what it doesn’t cover.
Floods don’t knock first. Here’s how DDoS protection keeps your server online, why it has to live in the network, and the few extra steps that protect your website too.
Arriving
Flood Real visitors
Your server receives
Real traffic only
The short answer
DDoS protection watches the traffic heading for your server and drops the flood before it arrives, so real visitors still get through. It works upstream, in the network, because no single server can absorb an attack that can be far bigger than its connection.
Every LiteKeep server has that filtering always on, for network floods (layers 3 and 4), at no extra cost. For attacks on your website itself (layer 7), you add caching and rate limits on the server, and this guide shows how.
Here’s a number that explains why DDoS protection has to live in the network, not on your server.
An open memcached server can amplify an attack 10,000 to 51,000 times. An attacker sending 10 Mbps of small requests to open memcached servers can point between 100 and 510 Gbps of replies at you. A typical VPS has a 1 Gbps port.
So what does “DDoS protection” actually do? It spots the flood and throws it away upstream, before it reaches your port, and lets your real visitors through.
Below: the three kinds of attack, the maths behind the giant floods, how filtering works on every LiteKeep server, and what to add for your website.
In this guide you’ll learn
- The three kinds of DDoS attack, and what stops each
- Amplification: how 10 Mbps becomes hundreds of Gbps, with a free calculator
- How filtering works: detection, scrubbing, clean traffic back
- Null routing: the blunt fix protection tries to avoid
- Layer 7 attacks, and what to add for your website
- What to do during an attack, step by step
Chapter 1
The short answer
DDoS protection is a filter in front of your server. Here’s what each part does.
| Step | What happens |
|---|---|
| Detect | Traffic to your address is watched all the time for patterns that don’t look like real use |
| Divert | During an attack, your traffic is routed through filtering equipment |
| Scrub | Flood packets are dropped; legitimate packets pass |
| Deliver | Clean traffic continues to your server, which stays reachable |
Chapter 2
The three kinds of DDoS attack
DDoS attacks come in three types. The type decides what can stop it.
| Type | What it does | Layer | Stopped by |
|---|---|---|---|
| Volumetric | Floods the connection so nothing else fits | 3 and 4 | Network filtering upstream, included on LiteKeep |
| Protocol | Abuses network protocols, such as half-open connections, to exhaust equipment | 3 and 4 | Network filtering upstream, included on LiteKeep |
| Application | Sends requests that look real to your website or app, wearing it out | 7 | Caching, rate limits and a web firewall on the app |
Application attacks target weak spots in the app itself, at layer 7. They can be small in volume and still slow a site down, so they’re handled where requests are understood: in front of or inside your app.
Chapter 3
Amplification: how 10 Mbps becomes 500 Gbps
Most giant floods are amplified. The attacker sends small requests to open servers on the internet while pretending to be you. The servers send large replies to you, and each protocol multiplies the traffic by a known factor.
Traffic arriving at your server
55.7 Gbps
That’s 56 times what a 1 Gbps port can carry, from 100 Mbps of NTP requests.
The attacker spoofs your address and sends small requests to open servers, which send large replies to you. No server can absorb this on its own: it has to be filtered upstream.
Every LiteKeep server filters layer 3 and 4 floods like this upstream, always on, at no extra cost.
| Protocol | Amplification |
|---|---|
| DNS | 28 to 54x |
| SSDP | 30.8x |
| CLDAP | 56 to 70x |
| CharGEN | 358.8x |
| NTP | 556.9x |
| Memcached | 10,000 to 51,000x |
All of this depends on forging the victim’s address. Networks that apply BCP 38 ingress filtering stop spoofed packets leaving their networks. Not every network does, which is why amplification still works, and why filtering has to sit upstream of you.
Chapter 4
How network filtering works
Network-level protection does three jobs, all before traffic reaches your server.
- Always-on detection. Traffic patterns to each address are watched continuously, so an attack can be spotted as it starts, without you having to report it.
- Scrubbing. During an attack, traffic is routed through filtering equipment that drops flood packets, like an amplified NTP flood or a wave of fake connection requests, and passes the rest.
- Clean delivery. What survives the filter reaches your server, so your service stays online during the attack.
On LiteKeep: every server has always-on network filtering for layer 3 and 4 floods, included at no extra cost, in all 15 countries. Traffic is diverted through scrubbing when an attack is detected. No add-on, no separate plan, no ticket needed.
Chapter 5
Null routing: the blunt fix
Without filtering, the classic response to a big flood is a null route, or blackhole: the network simply throws away all traffic to the attacked address.
Networks signal it with a standard tag that means: discard all traffic to this address. It protects everyone else on the network. But it drops your real visitors too, so the attacker gets exactly what they wanted: your server offline.
That’s the difference protection makes. Filtering throws away the flood; a null route throws away everything.
MythDDoS protection means nothing else to do.
Network filtering drops the floods. Your website still deserves caching and rate limits for layer 7, and chapter 6 shows how.
MythA firewall on my server stops DDoS.
It can drop packets, but only after they’ve filled your connection. Volumetric floods must be stopped upstream.
Chapter 6
Layer 7: what you need to add
Our network filtering handles floods. Layer 7 attacks look like real visitors, so you handle them where requests are understood: in front of or inside your app. With full root access on your LiteKeep server, every step below is yours to set up.
- Put a CDN or web firewall in frontHow to check: It absorbs and filters HTTP floods before they reach your server.
- Hide your server’s real addressHow to check: If attackers know your origin IP, they can bypass the CDN. Don’t expose it in DNS records, mail headers or old subdomains.
- Rate-limit expensive pagesHow to check: Login, search and checkout pages are favourite targets. Limit requests per address in Nginx or your app.
- Cache what you canHow to check: A cached page costs almost nothing to serve a thousand times.
- Add a challenge if neededHow to check: A challenge page tells people from bots while an attack is running.
Chapter 7
Game servers and DDoS
Game servers have special needs: they use UDP, they must stay low-latency, and even a short flood can ruin a match.
- Network floods against game servers are layer 3 and 4 attacks, which our filtering covers.
- Hide the address where your game allows it, for example with a proxy in front of a Minecraft network, so attackers can’t target the server itself.
- Keep a traffic monitor running, so you can tell a flood from a busy evening.
Sizing a Minecraft server? Our Minecraft RAM calculator tells you which plan to pick, and every one comes with the same filtering.
Chapter 8
What to do during an attack
A short response plan for a VPS. Keep it somewhere you can find it.
- Confirm it’s an attackHow to check: Compare traffic with your normal pattern. A traffic spike from a popular post looks different from a flood.
- Contact supportHow to check: On LiteKeep, filtering starts by itself. Write to support with the times and the address under attack, so we can look at it with you.
- Gather evidenceHow to check: Timestamps, source addresses, packet captures and logs. You may need them later.
- Switch on layer 7 defencesHow to check: If it’s an HTTP flood: CDN “under attack” modes, stricter rate limits, a challenge page.
- Review afterwardsHow to check: What was targeted, how it got in, and what you’ll change. Write it into a response plan.
Now it’s your move
DDoS protection isn’t magic. It’s a filter in the right place: upstream, always on, dropping floods so your server never sees them.
Every LiteKeep server includes that filtering for layer 3 and 4 floods, in all 15 countries, at no extra cost. Add caching and rate limits for your website and you’re ready. Your server is usually ready within 15 minutes, paid in crypto, and you can delete it any time. See what’s included.