> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/network-ddos-v3/introduction.md).

# Introduction

The Link11 Network DDoS Protection solution defends the autonomous systems (AS) of customers against DDoS attacks on OSI layers 3 and 4. It provides automated, multi-dimensional analysis of incoming traffic. When attacks are detected, they are mitigated immediately.

Its highlights include:

* [**Netflow DDoS Detector**](/product-guides/netflow-ddos-detector/introduction.md) as an optional add-on
* **Flexible architectural options**, including [asynchronous routing](/product-guides/network-ddos-v3/architecture-and-setup-options.md#additional-consideration-asynchronous-routing-incoming-traffic-only) (inbound traffic passes through Link11, outbound traffic goes from customer origin to local ISPs)
* **Optimal traffic routing**: inbound traffic will be directed across the Link11 backbone from the Point of Presence closest to the client, to the scrubbing center to which the customer is connected. Admins can also configure [BGP-based load balancing](/product-guides/network-ddos-v3/faq/load-balancing.md).
* **Native IPv6 support** — IPv4 and IPv6 traffic are handled with equal effectiveness throughout detection, baselining, and mitigation.
* **Auto-learned traffic baselines** that update continuously — no manual threshold tuning required.
* **Targeted mitigation** — only the strategies relevant to the detected attack vector are activated.

## Flexible configuration options

Network DDoS can be configured to:

* Scrub all traffic all the time ([always-on setup](/product-guides/network-ddos-v3/architecture-and-setup-options.md#the-recommended-option-always-on-setup))
* Scrub all traffic sometimes ([standby setup](/product-guides/network-ddos-v3/architecture-and-setup-options.md#standby-setup-part-time-filtering), ingesting and processing traffic only during attacks)
* Scrub some traffic all the time ([multi-ISP setup](/product-guides/network-ddos-v3/architecture-and-setup-options.md#multi-isp-setup-partial-filtering) during peacetime, but ingesting all traffic during attacks)

The system provides a dashboard showing the current state of traffic, administration of currently-blocked IPs, and reporting of attacks and related data.

## How it works

Network DDoS operates between the customer environment and the Internet. Using the Border Gateway Protocol (BGP), Link11 is positioned in front of customer networks, inspecting inbound traffic. Malicious traffic is dropped within the Link11 Scrubbing Center, while clean traffic is routed to the customer origin.

<figure><img src="/files/XJHDVzJzE1631MF7Thza" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
For an in-depth explanation of how Network DDoS filters attack traffic, see [How Network DDoS Detects and Mitigates Attacks](/product-guides/network-ddos-v3/faq/how-detection-and-mitigation-work.md).
{% endhint %}

### Traffic States

Network DDoS Protection is always in one of the following states.

#### Peacetime

No mitigation strategies are active. The system monitors all traffic, builds baselines, and collects signals — individual traffic anomalies that may indicate developing attack activity. Signals alone do not trigger mitigation.

Even during peacetime, Link11 scrubs incoming traffic and discards clearly invalid packets — for example, packets sent to a non-existent UDP port, malformed packets, or packets that do not conform to standard protocol behaviour.

#### Active Mitigations

When the system correlates multiple signals into a **high quality signal** — a confirmed attack signature — it activates the mitigation strategies relevant to that specific attack vector. For example, a TCP SYN flood triggers TCP SYN mitigations only; UDP handlers, GRE processing, and other strategies remain off.

Mitigation uses an escalation ladder, starting with the most targeted intervention and escalating only if the current level proves insufficient: bad packets → specific ports → broader ports → protocol → source IPs → source ASNs. The system continuously monitors effectiveness and de-escalates automatically as the attack subsides.

Known legitimate sources — automatically identified from the traffic baseline — are never blocked, even during an active attack.

#### Cooldown

When traffic returns to normal levels, the system enters a cooldown period before fully disabling mitigation. This prevents premature ramp-down if an attack is pausing or changing vector. Once the cooldown period completes without renewed attack activity, the system returns to peacetime.

Each period when mitigations were active is recorded as an Attack Event with a unique Attack ID (e.g., `ATK-2026-0043`), allowing customers to review and export details.