How Much DDoS Protection Do You Need? Sizing 100 Gbps to 10 Tbps

The answer to "how much DDoS protection do I need" is enough upstream filtering capacity to absorb the largest flood your exposure is likely to draw. For most business websites and APIs, that is the 100 Gbps of Layer 3 and Layer 4 protection included with every voxa.host server. Larger tiers suit servers that draw repeated large floods.

This guide explains what capacity measures, sizes it from your exposure rather than averages, and puts each tier price next to the cost of downtime.

What does DDoS protection capacity measure

DDoS protection capacity, also called DDoS mitigation capacity, is the volume of attack traffic that can be filtered upstream, before it reaches the port on your server. It is quoted in bits per second. Gbps vs Tbps is only a change of unit: one terabit is 1,000 gigabits, so a 10 Tbps tier is 100 times the 100 Gbps every voxa.host server includes.

Port speed is a different number. It is the size of the last link into your server: a guaranteed 1 Gbps unmetered port on a dedicated server by default, or 100 to 300 Mbps on a VPS, shaped by plan.

Port speed decides how much legitimate traffic you can serve. Protection capacity decides how large a flood can be dropped before it gets that far. Our guide to bandwidth and data transfer limits covers the port side.

Why a flood bigger than your port is survivable

A 1 Gbps port cannot carry a 50 Gbps flood, and with upstream filtering it never has to. The flood is dropped before it reaches your port, and only the remaining traffic travels on to you. Legitimate requests get through because the flood no longer competes with them for your link.

The same logic explains why a firewall on the server cannot stop a volumetric attack. By the time nftables or iptables sees a packet, that packet has already used your port. A server firewall protects the CPU and the application. Only filtering upstream protects the link.

Bits per second vs packets per second: why both matter

Floods are measured two ways. Bits per second is volume, and volume fills links. Packets per second is count, and count exhausts whatever has to inspect each packet: routers, firewalls, the kernel network stack and connection tracking tables.

The two can be far apart. A 1 Gbps link full of 1,500 byte packets carries roughly 80,000 packets a second. Fill it with the smallest Ethernet frames, 64 bytes each, and it carries roughly 1.5 million, about eighteen times as many, each needing its own routing decision and firewall lookup.

Reflection and amplification floods through DNS, NTP, memcached, CLDAP or SSDP tend to be large packets at high bit rates. SYN floods tend to be small packets at high packet rates.

Tiers are sold in bits per second because volume decides whether a flood can be absorbed upstream, and every tier filters both kinds at Layer 3 and Layer 4. On your side, keep the stack behind the filter sensible: drop ports you do not serve and size connection tracking for your real load.

How to size DDoS protection from your exposure

No list of average attack sizes will tell you what your server will draw. Floods are aimed at someone for a reason, so size from the reasons. Work through five questions:

• Public profile. Is the address published in DNS and known to many people, or does it only talk to a handful of systems you control?
• Competitors. Would anyone gain revenue or users while you are offline?
• Extortion risk. Is your revenue per hour visible from outside, with peak dates anyone could predict? That is what makes a business worth a ransom note.
• History. Have you been attacked before? An attack shows that someone has a motive, and motives rarely disappear within a month. A past null route, or a flood size a previous provider reported, is the best sizing data you have.
• Other people's enemies. Do you host sites, VPN endpoints or community platforms for others? Every customer brings their own exposure onto your addresses.

The answers map to a tier like this:

Profile	Suggested tier	Why
Databases, workers, CI runners and trading bots with no public endpoint	100 Gbps (included)	Few people know the address and nobody gains by flooding it
Company website, B2B application or small online shop with no attack history	100 Gbps (included)	Low motive, and the monthly allowance covers a rare flood above the cap
Busy public service with active competitors, or attacked in the past year	500 Gbps	Floods up to 500 Gbps sit inside the tier, however often they come
Hosting for third parties: reseller hosting, VPN or proxy endpoints, forums	1 Tbps	One server carries every customer's exposure
High revenue per hour, ransom demands received, or floods above 500 Gbps seen before	2 Tbps or 5 Tbps	Size above the largest flood you have seen, with room to spare
Public HTTP service under repeated attack that needs HTTP floods filtered upstream	10 Tbps + Layer 7	The only tier that filters Layer 7

A trading bot is the clearest case for the first row: it opens outbound connections and publishes nothing. If two rows fit, take the higher tier for the server that carries the public address, and read the section on where to spend before buying it for every machine.

Is 100 Gbps of DDoS protection enough

For most servers, yes. Every KVM VPS and every dedicated server includes 100 Gbps of always on Layer 3 and Layer 4 protection, filtered upstream and active from delivery, with nothing to switch on and no extra charge. That is 100 times a 1 Gbps dedicated port, and between about 330 and 1,000 times a VPS port.

What happens to attacks above 100 Gbps

The included tier comes with an allowance for floods that exceed it. The first 5 attacks in a month that go above 100 Gbps are still mitigated at no charge. From the 6th in the same month, the targeted IP address is null routed until the attack ends or the server is upgraded to a larger tier.

Null routing means the network drops all traffic to that one address, attack and legitimate alike. The address goes offline, while the server's other IP addresses stay reachable. If you keep a second server in another city, as in our guide to pairing two VPS locations for failover, you have somewhere to send visitors while it lasts.

Look at what has to happen before that point. Someone must find your address, want you offline, command more than 100 Gbps, and do it more than five times in one month. A server that sees that pattern has learned something about its exposure, and the answer is a larger tier, which you can add from the client area.

How much do DDoS protection tiers cost

Tiers are bought per server and cover every IP address on that server. Prices are per month and exclude VAT.

Tier	Layers	Per month
100 Gbps	L3/L4	Included
500 Gbps	L3/L4	€156.45
1 Tbps	L3/L4	€523.95
2 Tbps	L3/L4	€1,048.95
5 Tbps	L3/L4	€2,623.95
10 Tbps + Layer 7	L3/L4/L7	€4,723.95

You choose a tier as an add on at checkout when you order a VPS or dedicated server, or upgrade it later from the client area. Billing is a flat monthly price per server with no fee per attack, so a bad month costs the same as a quiet one. The same table is on our DDoS protection page.

Worked example: a tier against an hour of downtime

These figures are an example, not a benchmark. Use your own.

Example: an online business turns over €100,000 a month, almost all of it through one web application. A month has about 730 hours, so the average hour is worth about €137. If most sales happen in around 300 busy hours, a busy hour is worth about €333.

Add staff who cannot work and the support load afterwards, say €150 an hour, and a busy hour offline costs this example business roughly €480. Against that figure:

• 500 Gbps at €156.45 a month costs about a third of one busy hour.
• 1 Tbps at €523.95 costs about one busy hour.
• 2 Tbps at €1,048.95 costs a little over two.
• 5 Tbps at €2,623.95 costs about five and a half.
• 10 Tbps with Layer 7 at €4,723.95 costs nearly ten.

A tier does not need to prevent a disaster to pay for itself. It only needs to save more hours than it costs. For this example business, 500 Gbps breaks even if it prevents one null routed busy hour every three months. If the same business has never been attacked, its expected loss is close to zero and the included tier is the rational choice.

Do all your servers need the same DDoS protection tier

No. Protection is bought per server, so put the public endpoints on one server with the larger tier and keep everything else off the public internet. A typical layout:

• A front server running nginx or HAProxy that terminates TLS and forwards requests, set up as in our nginx reverse proxy guide. It carries the published address and the larger tier.
• Application, database and worker servers that accept connections only from the front server and your own admin addresses. They keep the included 100 Gbps anyway.

Example: three dedicated servers, each with 1 Tbps DDoS protection, cost 3 × €523.95, or €1,571.85 a month in protection. The tier on the front server alone costs €523.95, a saving of €1,047.90 a month. On a Dual Xeon E5 2690 v4 at €249 a month, a 1 Tbps tier costs more than twice the server, so paying it once instead of three times matters.

This only works if the backends stay hidden. Keep their addresses out of DNS, including old records and forgotten subdomains, and do not send mail directly from them, because mail headers carry the sending address.

Outbound calls such as webhooks also reveal the source address to whoever receives them. Then firewall every backend so that only the front server and your admin addresses can connect.

Does more capacity stop Layer 7 attacks

Capacity measures volume, and a Layer 7 attack is not about volume. An HTTP flood sends requests that look like real visitors, often at a modest bit rate, and each one costs your application CPU time and database queries. Only the 10 Tbps DDoS protection tier filters Layer 7 (HTTP) floods upstream. On every other tier, HTTP floods are handled in your own stack with rate limits, caching and connection limits, so moving from 500 Gbps to 5 Tbps adds no HTTP filtering at all.

Choosing a DDoS protection tier on voxa.host

Start from exposure, not from the biggest number. Most servers are well served by the included 100 Gbps, and the ones that need more usually learn it from their own history. The DDoS protection page sets out the tiers and the allowance above 100 Gbps in one place.

Every dedicated server and every KVM VPS ships with 100 Gbps of always on L3/L4 protection. Pick a larger tier at checkout for the server that carries your public address, and leave the rest on the included tier.