# What is DDoS Mitigation?

> DDoS mitigation is the combination of architecture, services, controls, and response procedures used to keep an online service available during a distributed denial-of-service attack.

- Canonical URL: https://yellowcube.eu/glossary/distributed-denial-of-service-mitigation/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It aims to distinguish or constrain harmful traffic, absorb demand, preserve critical capacity, and restore normal operation. Because DDoS attacks can target bandwidth, network protocols, or application resources, no single filtering device addresses every case.

Effective mitigation is prepared before an attack. Organizations need service baselines, upstream-provider contacts, protected DNS and routing, tested traffic-diversion procedures, capacity appropriate to the threat, and a clear decision path for activating external support.

### Key points

- **Distribution and absorption:** Anycast, content delivery, caching, redundant regions, and appropriately designed capacity can reduce concentration on one service path.
- **Filter placement:** Upstream providers and scrubbing services can discard attack traffic before it saturates the victim’s internet connection; local controls can handle attacks that reach the application or network edge.
- **Resource protection:** Rate controls, connection protections, request validation, queues, and application-specific rules can keep expensive operations from being exhausted.
- **Plan testing:** Test detection, escalation, traffic diversion, provider response, fallback services, communications, and safe return to normal routing.
- **Important limitation:** “Unlimited” or automatic protection is not a guarantee. Provider capacity, regional reach, activation time, false positives, encrypted traffic, application dependencies, and cost controls all affect outcomes.

### Related terms

[Distributed denial-of-service (DDoS) attack](<https://yellowcube.eu/glossary/distributed-denial-of-service-attack/>) · [Cyber resilience](<https://yellowcube.eu/glossary/cyber-resilience/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>) · [Domain Name System (DNS) security](<https://yellowcube.eu/glossary/domain-name-system-security/>)

### Sources

[CISA: Understanding and Responding to DDoS Attacks](https://www.cisa.gov/sites/default/files/2024-03/understanding-and-responding-to-distributed-denial-of-service-attacks_508c.pdf) · [CISA: Volumetric DDoS Mitigation Guidance](https://www.cisa.gov/sites/default/files/2023-09/TLP%20CLEAR%20-DDOS%20Mitigations%20Guidance_508c.pdf) · [BCP 38 / RFC 2827: Network Ingress Filtering](https://www.rfc-editor.org/info/rfc2827/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.