Skip to content
Bullionet
Network

DDoS protection

What the volumetric filtering in front of your server covers, what it does not, and what to do while an attack is running.

Volumetric filtering runs in front of every Bullionet server, on by default, included in the monthly price. It works at layers 3 and 4: floods, amplification and reflection, malformed packets, saturation of the link itself. There is nothing to enable and nothing to pay.

What it covers ​

  • SYN, ACK and other TCP state floods.
  • UDP floods and amplification through DNS, NTP, memcached and their relatives.
  • ICMP floods and fragmented packet attacks.
  • Any traffic large enough to threaten the link rather than the application.

Mitigation engages automatically. Clean traffic keeps flowing while the attack is scrubbed.

What it does not cover ​

Filtering at layer 4 cannot tell a legitimate HTTP request from a hostile one. Attacks aimed at your application still reach it:

  • Request floods on expensive endpoints: search, login, export, anything that hits your database.
  • Slow-connection attacks that hold sockets open.
  • Credential stuffing and scraping, which look like traffic because they are traffic.

Those are yours to handle, on the server:

  • Rate limit per IP at the reverse proxy, on the endpoints that cost the most.
  • Set aggressive timeouts on idle and slow connections.
  • Cache what can be cached, so a flood hits the cache and not your application.
  • Put a CAPTCHA or a proof-of-work step in front of login and signup forms.

While an attack is running ​

  1. Check whether the link or the application is saturated. High traffic with a responsive server is layer 7; a server that answers on the out-of-band console but not on the network is layer 3 or 4.
  2. Read the return path on lg.bullionet.com.
  3. Open a ticket with the timestamps and the timezone, the destination IP and port, and what you observe. Filtering decisions get much better with the target port in hand.
  4. Keep your own logs. Once mitigation kicks in, the attack traffic no longer reaches the server, so what your logs already hold is the evidence.

Note

Attacks against a specific port are easier to filter than attacks against a whole address. Tell us the port.

Outbound traffic ​

Filtering protects your server. It also watches what leaves it. A compromised machine that starts sourcing attack traffic, sending spam or scanning gets filtered and you get a ticket. If you receive one, take the server off the network first and investigate second: a rebuild from a clean image is usually faster and safer than cleaning a compromised system in place.

Reviewed on September 1, 2026