Volumetric attack

Why raw bandwidth matters here

A volumetric attack is a numbers problem before it is a configuration problem. If the incoming traffic volume exceeds what the network link into the server can physically carry, no server-side rule can let legitimate traffic through, because it never arrives in the first place.

Where mitigation actually happens

Because the bottleneck sits at the network level, effective mitigation typically happens upstream, at the hosting provider or through a specialized scrubbing service, rather than through any configuration change made on the server itself.

Our DDoS protection guide for small businesses explains what you can do yourself and what needs help from upstream providers.

Measuring the flood from your own server

Volume is described in bits per second and packets per second, and both are worth reading off the machine before you call anyone. The kernel keeps per-interface counters, so sampling them twice gives you the rate:

ip -s link show eth0
sar -n DEV 1 5
tcpdump -nn -i eth0 -c 50 udp

Replace eth0 with your interface name. The first command prints received and transmitted packet and byte totals (run it twice and subtract). The second, from the sysstat package, prints per-second rates for five seconds. The third captures 50 UDP packets without name lookups, which is enough to see whether the flood targets one port or sprays many, and what the source addresses look like. Compare the received rate with the port speed in your hosting plan. If incoming traffic is close to that speed, the link itself is full and no rule on the server can change that, as described above. What you gather here is exactly what your provider's support will ask for. For a sense of how large attacks get across the internet, see the Cloudflare H1 2026 report breakdown, and for the layered defense a small site can afford, the DDoS protection guide.

Reflection and amplification: do not become the weapon

Many large floods are reflected. As CISA alert TA14-017A explains, UDP is connectionless and does not validate source addresses, so an attacker forges the victim's address and public servers send their replies to the victim instead. Amplification is the ratio between the small request and the large reply. CISA's table lists DNS at 28 to 54, SSDP at 30.8 and NTP at 556.9.

Your server can be one of those reflectors if it answers UDP requests from anywhere. List what is listening and close what you do not need:

ss -ulnp

CISA's advice is to remove unwanted services or deny internet access to them. A default-deny policy in your firewall does this for every port you did not open on purpose. The other defenses sit with providers: ingress filtering against spoofed packets (BCP 38), and remotely triggered blackholing, which discards traffic aimed at the victim address upstream. Ask your provider which of these they offer before you need them.

For a sense of scale and where volumetric defence stops, see the Yandex data center resilience analysis.

Related terms: Protocol attack, Application-layer attack, Firewall, Botnet.