The three mechanisms every provider sells
1. Absorption via anycast
Anycast announces the same IP from dozens of global locations, so attack traffic gets smeared across the provider's backbone instead of your single uplink. This is how edge networks survive multi-terabit floods — no single site ever sees the full volume.
2. Scrubbing upstream
Traffic is routed through "scrubbing centers" that drop attack packets before they reach you: signature filters for known floods, rate shaping, SYN proxies that complete handshakes on your behalf, and behavioral filters for L7 junk.
3. Origin concealment
The proxy becomes your public face. Attackers who can't find your real IP can't bypass the mitigation layer — which is why origin-IP hygiene (DNS history, cert logs, direct connections) is half the battle.
Always-on vs on-demand
| Model | How it works | Pros | Cons |
|---|---|---|---|
| Always-on | All traffic permanently proxied | Instant mitigation, L7 covered | Higher cost, added latency, TLS termination at provider |
| On-demand | DNS/BGP swing during attack | Cheaper, no daily latency | Minutes of downtime per swing, weak against short bursts |
| Hybrid | Cloud + appliance on-prem | Best coverage for enterprises | Complexity, two vendors to manage |
Questions that expose weak vendors
- "What's your scrubbing capacity in Tbps, and is it per-region or global?" — a claimed 10 Tbps global may be 200 Gbps near you.
- "Time-to-mitigate — automatic or manual?" — minutes matter; "open a ticket" is not mitigation.
- "Do you cover L7 attacks, or only L3/L4?" — HTTP floods defeat cheap plans.
- "What happens past my plan's threshold — null-route or upgrade?" — the honest answer decides whether you're protected or evicted mid-attack.
- "Can I run an authorized test?" — serious providers welcome scheduled verification; it's how you prove the SLA is real.
Realistic pricing landscape
| Tier | Typical price | What you get |
|---|---|---|
| Free (e.g. Cloudflare free plan) | $0 | Unmetered L3/L4 absorption, basic L7 — genuinely strong for small sites |
| Pro/business CDN | $20–250/mo | WAF, rate limits, faster SLA |
| Dedicated mitigation | $1k–10k+/mo | Guaranteed capacity, custom rules, engineer support |
| On-prem appliance | $20k+ hardware | Only makes sense with multi-Gbps enterprise links |
The mistake most buyers make
Buying mitigation and never testing it. Flood thresholds, null-route triggers and rule coverage are all "trust me" until you've run a controlled, authorized load test through the protected path. Either negotiate test windows with your provider, or use a verification-requiring stress service scoped to your own infrastructure — but verify something. For background on the threat model you're buying against, see Cloudflare's DDoS primer and Radware's knowledge center.