What Is DDoS-Protected VPS/VDS? L3/L4, L7, Scrubbing and Gbps

What DDoS protection is trying to solve

A DDoS attack attempts to exhaust service capacity through packets, connection state, application requests or backend resources. Protection systems try to separate malicious traffic and deliver clean traffic to the origin.

Not every attack is a bandwidth flood. A relatively small HTTP flood that triggers expensive database work can disrupt an application more effectively than a larger volumetric attack.

L3/L4 attacks: packets and connections

UDP floods, SYN floods, ACK floods and amplification/reflection attacks operate at network/transport layers. Packet rate, bandwidth, connection tracking and upstream capacity matter.

Cloudflare's network-layer ruleset lists many attack vectors separately. If a provider advertises L4 protection, ask which protocols and vectors are actually covered.

L7 attacks: the application has to do work

HTTP GET/POST floods, cache-bypass requests and attacks on login/search/checkout endpoints can exhaust CPU, PHP workers, DB connections and API quotas. Network scrubbing alone may not understand application cost.

WAF, rate limiting, bot management, caching and application-aware DDoS protection become important here. Cloudflare handles HTTP/HTTPS DDoS with a separate L7 ruleset.

What a scrubbing center does

Scrubbing infrastructure filters incoming traffic, drops attack packets and forwards clean traffic to the origin. It can be implemented through on-demand BGP diversion, always-on proxies or provider edge networks.

Important questions include how clean traffic returns, whether IPs change under attack, whether GRE/BGP is used, mitigation activation time and protected protocols.

How to interrogate a '10 Gbps DDoS protection' claim

The number alone is insufficient. Is 10 Gbps the total upstream, per-customer mitigation cap, scrubbing capacity, or only volumetric L3/L4 coverage? Ask about packet rate, connections, game protocols and L7 separately.

A high-PPS small-packet attack can overload firewalls or CPUs while bandwidth remains modest. Comparing protection only by Gbps is incomplete.

When blackholing/null-routing appears

If mitigation capacity or policy thresholds are exceeded, a target IP may be blackholed, dropping all traffic. Ask about blackhole thresholds, duration and automatic recovery.

Game-server and website protection differ

Minecraft, Rust, FiveM and UDP-heavy games need protocol-aware L4 filtering and low latency. Web applications benefit more from reverse proxies, caching, WAF and L7 rate limiting. Protection must match the workload.

Nine questions before buying

Ask whether protection is always-on, whether L3/L4 and L7 are separate, max Gbps/Mpps, protocol coverage, blackhole thresholds, IP changes, clean-traffic latency, reporting and attack-related billing. These answers matter more than a DDoS badge.