Resilience has several layers
Understand the planned mitigation envelope and the layers your application still needs.
Content revised · English
- Catalogue capacity range
- 10–400 Gbps
- Layers to distinguish
- L3 / L4 / L7
- Prepared detection target
- Under 60 seconds
Prepared per-plan mitigation specifications.
Requires a live mitigation provider and measurement.
Keep these in view.
- A 400 Gbps mitigation envelope is not a 400 Gbps server port.
- Network filtering and application protection cover different problems.
- The capacity and timing are prepared specifications, with no live mitigation attached.
Capacity belongs to an exact plan
The prepared catalogue specifies mitigation capacities from 10 to 400 Gbps. Compare the figure on the selected plan rather than assuming every product includes the largest envelope. Mitigation capacity, the server port speed and the monthly transfer allowance describe different limits.
From detection to traffic filtering
The proposed network design detects an attack, diverts traffic through filtering and returns permitted traffic to the origin. Its planned detection and activation target is under 60 seconds. A launch configuration must verify the upstream service, routing method, attack coverage and behaviour beyond the included capacity before that becomes an operational commitment.
What a network shield does not solve
L3/L4 filtering addresses network and transport traffic patterns. An expensive search request, login flood or application exploit can still require L7 controls: caching, request limits, authentication, a WAF where appropriate and application tuning. Encrypt origin traffic and restrict direct access when using a proxy.
Make response observable
Record the first symptom, scope, request rates, network counters and ticket timeline. Keep an independent status and recovery route. Decide in advance who can change filtering or block a noisy path; overly broad emergency rules may also interrupt legitimate users.
- Ask which attack types and destinations are covered.
- Ask whether large attacks trigger a null route, extra charges or manual review.
- Test alerts and recovery after the filtering is removed.
Recognise the traffic pattern
UDP reflection and amplification can abuse exposed DNS, NTP, SSDP or memcached services. SYN floods pressure connection handling, while repeated expensive application requests can exhaust CPU or a database at a much lower bit rate. Identify the pattern before choosing a response; a local firewall cannot recover bandwidth already saturated upstream.
- Restrict exposed services so the server does not become a reflector.
- Anycast can distribute ingress across several sites, but BGP routing does not guarantee the geographically closest site or replicate application state.
- These are network-design concepts; no OmbraHost anycast network or connected scrubbing path is asserted.
Questions, answered.
Is every product protected at 400 Gbps?
No. The catalogue lists the mitigation value on each plan. Use that exact figure alongside its port and transfer allowance.
Does this include a managed WAF?
The local specification does not establish a connected managed WAF. Application filtering and tuning must be explicitly included in a future live contract.
Will all legitimate traffic remain untouched?
Filtering needs thresholds and can produce false positives. A live operator should explain escalation, exclusions and how rules are adjusted during an incident.
Is mitigation always active?
The prepared design calls for automatic network detection and filtering, with a target under 60 seconds. No active upstream mitigation service is connected to this application.
What happens above a plan’s mitigation envelope?
A live contract must state escalation, manual review, possible null routing and any extra capacity charge. The catalogue does not invent an operational outcome for an attack it cannot measure.
Is filtering based only on country?
Geographic blocking is a different control and may exclude legitimate users. An upstream design needs to explain its attack signals and filtering rules; no OmbraHost GeoIP-only scrubbing claim is made.
How much latency does filtering add?
There is no measured OmbraHost filtering path. Test the actual route before and during an agreed exercise; a fixed untested millisecond claim would not describe your application.
Can filtering be disabled for a test?
A production operator should review the scope and risks before any change. The website has no live filtering switch.