> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/network-ddos/introduction.md). # Introduction The Link11 Network DDoS Protection solution defends the autonomous systems (AS) of customers against DDoS attacks on OSI layers 3 and 4. It provides automated, multi-dimensional analysis of incoming traffic. When attacks are detected, they are mitigated immediately. Its highlights include: * [**Netflow DDoS Detector**](/product-guides/netflow-ddos-detector/introduction.md) as an optional add-on * **Flexible architectural options**, including [asynchronous routing](/product-guides/network-ddos-v3/architecture-and-setup-options.md#additional-consideration-asynchronous-routing-incoming-traffic-only) (inbound traffic passes through Link11, outbound traffic goes from customer origin to local ISPs) * **Optimal traffic routing**: inbound traffic will be directed across the Link11 backbone from the Point of Presence closest to the client, to the scrubbing center to which the customer is connected. Admins can also configure [BGP-based load balancing](/product-guides/network-ddos-v3/faq/load-balancing.md). ## Flexible configuration options Network DDoS can be configured to: * Scrub all traffic all the time ([always-on setup](/product-guides/network-ddos-v3/architecture-and-setup-options.md#the-recommended-option-always-on-setup)) * Scrub all traffic sometimes ([standby setup](/product-guides/network-ddos-v3/architecture-and-setup-options.md#standby-setup-part-time-filtering), ingesting and processing traffic only during attacks) * Scrub some traffic all the time ([multi-ISP setup](/product-guides/network-ddos-v3/architecture-and-setup-options.md#multi-isp-setup-partial-filtering) during peacetime, but ingesting all traffic during attacks) The system provides a dashboard showing the current state of traffic, administration of currently-blocked IPs, and reporting of attacks and related data. ## How it works Network DDoS operates between the customer environment and the Internet. Using the Border Gateway Protocol (BGP), Link11 is positioned in front of customer networks, inspecting inbound traffic. Malicious traffic is dropped within the Link11 Scrubbing Center, while clean traffic is routed to the customer origin.
{% hint style="info" %} For an in-depth explanation of how Network DDoS filters attack traffic, see [How Network DDoS Detects and Mitigates Attacks](/product-guides/network-ddos-v3/faq/how-detection-and-mitigation-work.md). {% endhint %} ## Three modes of security posture Network DDoS Protection will always be in one of three modes: * Peacetime * Suspicion * Attack mode ### Peacetime mode (traffic scrubbing only) When traffic sources are behaving as expected, the system is in “peacetime” mode and will not block any IPs. This does not necessarily mean that all incoming traffic will be sent to the customer. Some incoming requests can be harmful even if not intended to be malicious. For example, malformed packets can, under certain circumstances, cause problems for the receiving network. To address this, even during “peacetime”, Link11 scrubs incoming traffic and neutralizes these potentially harmful requests. #### "Scrubbing" For example, the system can discard packets that are sent to a non-existent UDP port (e.g. port 0), or that do not conform to standard protocols, or that contain other unusual or suspicious characteristics. Because these anomalies do not necessarily indicate malicious intent, the system does not (yet) treat them as indicators of an attack. It does however prevent them from reaching the origin. ### Suspicion mode In this mode, one or more IPs have displayed some anomalous behavior, but the anomalies do not (yet) meet the criteria for a full attack. In this situation, Link11 maintains an internal list of suspicious IPs. If a traffic source continues its anomalous behavior, it will be blocked. Meanwhile, a “DDoS Event” will be displayed in the Dashboard, so that the customer can investigate further if desired. ### Attack mode **Attack Mode** is activated when the Link11 system detects one or more IP addresses actively attempting to disrupt the customer’s network. This can happen **automatically** during a DDoS attack detection or be [**manually enabled**](/using-link11/how-do-i.../manually-set-link11-into-attack-mode.md) by an administrator. #### Traffic Routing and Activation Conditions Attack Mode can only be applied to traffic currently routed through Link11. Customers can configure routing in one of the following states: * **Always-On Routing** – All traffic is [continuously routed](/product-guides/network-ddos-v3/architecture-and-setup-options.md#the-recommended-option-always-on-setup) through Link11. * **Dynamic Routing** – Traffic is routed to Link11 only during attacks, using Cloud Insights and automated rerouting. * **On-Demand Routing** – Traffic is routed to Link11 only during attacks, with rerouting initiated manually by the customer. If the system is not in Always-On mode, Attack Mode requires that traffic first be routed to Link11 by one of the other methods. #### How Attack Mode Works Once in Attack Mode, the system: * Blocks IPs on the Suspicious IP List, prioritizing the most aggressive sources first. * Attempts to normalize traffic to pre-attack patterns. * Generates alerts and dashboard reports for visibility. Filtering is adaptive, starting with high-volume malicious sources and expanding to unusual traffic patterns compared to the customer’s baseline. {% hint style="warning" %} **Note:** Manual activation of Attack Mode can be used proactively, but may increase the risk of false positives. {% endhint %} #### Deactivation Attack Mode—whether triggered manually or automatically—exits once traffic patterns stabilize. This transition is handled automatically.