Asymmetric filtering
Inbound traffic passes through DDoS filtering. Your services’ return traffic does not need to use the same filtering path, allowing protection to fit an asymmetric network architecture.
DDoS Protection · AS51202
DDoS protection that knows your traffic
Asymmetric filtering, automated profiling and adaptive thresholds for your applications. 95% of legitimate traffic forms the learning baseline. During an attack, learning pauses while protection stays active.
Under attack right now?
Protection starts before your connection.
If a link is already saturated with attack traffic, a rule on the server behind it has limited effect. Network mitigation acts earlier: traffic is filtered before it reaches the customer connection being protected.
AS51202 filters asymmetrically: inbound traffic passes through protection, while return traffic does not have to follow the same filtering path. Automated profiling and adaptive learning align filtering with your services’ legitimate traffic.
View connectivity and transit pricingInternet traffic
Legitimate connections and attack traffic
Network filtering
Handle attack patterns under the agreed profile
Your connection
Enable legitimate use of your services
Simplified illustration of the principle. Routing and filtering profiles are agreed for the specific connection.
Asymmetric · Automated · Adaptive
Protection learns your legitimate traffic.
AS51202 combines asymmetric filtering with automated profiling and adaptive threshold learning. Thresholds follow your services’ traffic behaviour. During an attack, learning pauses while filtering continues.
Explore filters and supported applicationsNormal operation
95% legitimate traffic
Learning baseline for the profile and adaptive thresholds.
During an attack
Learning paused. Filtering active.
Filtering continues to use the previously learned baseline.
Automated profiling
The system learns your applications’ regular traffic behaviour and builds a profile from it. What matters is the actual network traffic of your software, from established game servers to custom applications.
Adaptive threshold learning
95% of legitimate traffic forms the learning baseline. Thresholds are adapted to normal traffic behaviour on that basis, aligning filtering with how your services operate.
Learning pauses during an attack
Learning is stopped during an attack. Filtering remains active and uses the previously learned baseline, preventing attack traffic from being adopted as normal behaviour.
DDoS protection, firewall or WAF?
These controls complement each other. A sound design makes clear where each control acts and which services it covers.
Network mitigation
Bandwidth and packet processing
Acts before the customer connection and filters attack traffic according to the agreed protection profile. Relevant to UDP floods or attacks on TCP connection establishment, for example.
Filtering must account for legitimate protocols. Gbps alone does not describe protection.
Firewall
Access to networks and services
Defines which connections are allowed. Depending on the system, it also checks connection state. It remains an important part of your own infrastructure.
A firewall behind a saturated connection cannot create additional link capacity.
WAF and application protection
HTTP requests and web applications
Evaluates web requests and adds application-specific rules. The application itself also needs suitable limits on expensive operations such as search or login.
A WAF does not provide general protection for arbitrary UDP services. Confirm its scope separately.
Protection for your IP transit
DDoS protection is included with IP transit. You do not need to know the right protection tier yet: describe your services and planned connection. We agree the protection scope together and record it in your proposal.
Get a protection recommendationAlready know your protection tier?
What your application needs from protection
Hosting and your own networks
With multiple customer services, protected prefixes, shared bottlenecks and escalation paths need to be clear. Include IPv4, IPv6 and additional upstreams in your design.
For acceptance testing: Map prefixes and routing; verify reachability over failover paths too.
Plan multihomingGame servers and UDP services
A reachable IP address says little about whether players can join or sessions remain active. Discuss protocols, packet patterns and legitimate traffic bursts.
For acceptance testing: Test new sessions, active connections, packet loss and reconnections.
Prepare game server acceptance testsWeb applications and APIs
A saturated uplink and an overloaded application need different controls. Plan network protection together with the requirements for HTTP filtering, a WAF and the application itself.
For acceptance testing: Check login, API calls and expensive endpoints; assign responsibility for each protection layer.
Compare protection layersWhy you need DDoS protection
DDoS attacks can overload bandwidth, connection state or applications. The right mitigation depends on the affected resource and must account for legitimate users.
Understand Gbit/s and Mpps in DDoS proposalsVolumetric (L3/L4)
UDP, ICMP and amplification floods fill the link until legitimate users are locked out.
Protocol attacks
SYN floods can put pressure on TCP connection establishment and the resources reserved for it.
Application (L7)
Disguised HTTP floods hit expensive endpoints and are hard to tell from real users.
From enquiry to protected operation.
A protection plan needs more than a tier name. These four steps make technical requirements, responsibilities and acceptance criteria concrete.
Plan your connection with usMap services and traffic paths
Start with your location, bandwidth, IPv4/IPv6 prefixes and existing upstreams. Add the ports, protocols and applications that need to remain available.
Agree the handoff and protection scope
We discuss connectivity options, routing and the appropriate protection tier. Responsibilities, escalation and agreed SLA terms belong in the proposal.
Test real user workflows
Automated profiling learns your services’ legitimate traffic. Check login, connection establishment, active sessions and reconnections. Agree checks, authorisations and a rollback plan before going live.
Plan operations and changes
Document contacts and relevant measurements. New applications, prefixes or upstreams can change the protection requirements and should be reviewed.
DDoS guides for planning and operations
Explore the questions that matter for your infrastructure: protection scope, acceptance testing, routing and incident response.
DDoS Protection, Firewalls and WAFs: What Protects Each Part of Your Infrastructure?
A saturated uplink, exhausted connection tables and overloaded web applications need different controls. Here is how to plan the protection layers together.
DDoS Protection for Game Servers and UDP Services: A Practical Acceptance Check
Reachability alone is not enough for real-time services. Check new connections, active sessions and reconnects against clear acceptance criteria.
Understanding DDoS Capacity: Gbps, Mpps and the Questions That Matter
Large capacity figures alone say little about protection for your services. Compare bandwidth, packet rate, measurement conditions and the agreed service scope.
Reading DDoS Reports: The Evidence That Matters After an Attack
A large attack peak does not prove service availability. Connect traffic charts, user impact and follow-up actions in a useful operational report.
DDoS Response Plan: The First 30 Minutes of an Attack
Improvisation is costly when services fail. This checklist structures detection, escalation, mitigation and communication for the first 30 minutes.
BGP Multihoming: Planning Redundancy with Two Upstreams
Two links alone do not create resilient redundancy. This guide shows how prefixes, policies, failover and DDoS mitigation fit together.
Questions before you decide
Does protection work with custom software?
Yes. Adaptive learning makes protection independent of the software you use. Automated profiling captures legitimate network traffic rather than limiting support to a fixed application list. Custom software can be integrated too. For setup, tell us the services, ports, protocols and typical user workflows.
What does asymmetric filtering mean?
Inbound traffic passes through filtering; return traffic does not have to follow the same filtering path. We align the protected ingress paths and the return route with your network architecture.
What baseline does adaptive learning use?
95% of legitimate traffic is used as the learning baseline. The system adapts thresholds to your services’ normal traffic behaviour. Learning stops during an attack; filtering remains active using the previously learned baseline.
Is DDoS protection included with IP transit?
Yes. AS51202 provides DDoS-protected IP transit with Standard or Premium. We determine the appropriate tier from your protocols, traffic and requirements, and document the agreed protection scope in your proposal.
Does DDoS protection replace my firewall or WAF?
No. Network mitigation, firewalls and web application firewalls serve different purposes. Network mitigation aims to reduce attack traffic before the customer connection. A firewall enforces access rules; a WAF inspects web requests. L3/L4 protection alone does not establish coverage for HTTP attacks.
Can protection be planned for game servers and UDP services?
Yes. Tell us your games or applications, ports and protocols. Planning covers more than reachable IP addresses: joining, active sessions and reconnections matter too. We agree specific filters and acceptance criteria for your service.
What should I consider for IPv6 and multiple upstreams?
Identify your IPv4 and IPv6 prefixes and every path through which traffic reaches your services. Protection on one transit path does not automatically cover other ingress paths. Plan and test routing, protection scope and failure behaviour together.
What information do you need for a quote?
Start with your location, required bandwidth and a description of your services. Your ASN, prefixes, ports and protocols, existing connectivity and any attack reports are also useful. We work through outstanding technical details with you.
Can I keep my existing provider?
An additional connection can be part of a multihoming design. The key questions are which traffic paths are protected and how prefixes are announced. An unchanged existing connection is not protected simply by enquiring with AS51202; the integration must be confirmed first.
How can I verify protection before going live?
Agree scope, authorisations, a test window and stop conditions with every involved operator. Check real user workflows, packet loss and reconnections. Load or attack tests must only involve explicitly authorised systems and paths.
What should I do during an ongoing attack?
Inform your current provider and prepare affected IP addresses, the start time with time zone, symptoms and available measurements. For a new protection connection, contact noc@nuxoa.de or +49 8141 3158900. An enquiry does not activate protection; we will agree connectivity and activation with you.
Find the right protection for your services
Talk to our engineers about the right protection tier or start a free trial.