A hosting network is a single failure domain with hundreds of tenants inside it. One attacked IP can saturate a shared uplink, and the traditional answer - null-routing the target - hands the attacker exactly what they wanted. We filter per destination and per prefix at the same time, so the attacked customer stays reachable and the neighbours never notice.
The modern attack does not aim at one IP. It spreads a few hundred thousand packets per second across every address in a /24, so no single host crosses a per-IP threshold and nothing fires, while the aggregate saturates the uplink. We measured exactly this: a prefix taking 1,117,215 pps while its busiest single address sat far below its own budget.
Shared uplinks, shared edge routers and shared scrubbing budgets mean the blast radius of an attack on a €4 VPS is the entire cabinet. Per-customer thresholds are the only honest way to bound it, and a single fleet-wide rate limit cannot express them.
DNS, NTP and CLDAP reflectors inside a hosting range are a permanent liability: they are abused to attack third parties, and the backscatter that returns is indistinguishable from an attack on you.
Every destination is budgeted individually and the prefix is budgeted as a whole, evaluated on the same packet. A carpet bomb trips the aggregate even though no host trips its own, and a single-target flood trips the host even though the prefix is quiet.
Protected ranges are announced normally and keep working. There is no blackhole community, no null route and no customer taken off the internet as a mitigation step - the thing that makes support tickets and churn.
A game server, a mail host and a backup target in the same /24 have nothing in common in their traffic shape. Thresholds are set per destination against measured baselines rather than one number for the range.
Rate limits on answerless DNS responses, suspect query floods and the full reflector set - chargen, CLDAP, rpcbind, memcached, MS-SQL, SSDP, SNMP, NetBIOS, WSD, CoAP - applied per destination /24 so a compromised resolver does not poison the whole range.
ISO 9001ISO 27001PCI-DSSGDPRNIS2 The mitigation is one layer. The same network sells the layers around it - and a stack bought from one operator has nobody in it to blame somebody else.
Buy the upstream and the mitigation as one thing: 1G-400G ports, full table, 95th percentile billing - and every prefix protected from the day it is turned up. One invoice, one NOC, and no finger-pointing between the carrier and the scrubber. The transit page →
E-Line or E-LAN between facilities for replication and internal VLANs - or a wavelength when the packet layer should be yours. Growing into a second metro stops being a renumbering project. EVPN-MPLS transport →
Taking your first 100G port is a project: router selection, routing policy, redundancy. We design it, rent you the same Juniper platforms we run if you would rather not buy them, configure everything and stay on support afterwards. How an engagement runs →
Protection for other sectors
This site sets zero cookies - no analytics, no trackers, no profile of you. The only third-party requests are the fonts, served by Google Fonts, and the spam check on the contact form. Everything else stays between your browser and our network - the full privacy note.