Preparing for DDoS: The Difference Between Layer 3-4 and Layer 7

DDoS (distributed denial of service) attacks overload a service to make it unusable. There is no single type of attack, and no single tool defends against them all. This article summarises the two main attack classes and the defence approach for each.

Layer 3-4: Volumetric attacks

Attacks such as SYN floods, UDP floods and DNS/NTP amplification fill network bandwidth and connection tables. The target is not the server but the pipe itself; an attack can reach hundreds of Gbps. A server-side firewall cannot stop these because the line fills before traffic reaches the server.

Defence: a large-capacity scrubbing centre in the provider network, anycast routing and automatic traffic diversion via BGP. At Ovabit 1.2 Tbps of scrubbing capacity is free on all plans.

Layer 7: Application attacks

HTTP floods, slow POST (Slowloris) and bot requests to heavy endpoints such as search forms or carts consume high CPU with low bandwidth. Traffic looks legitimate and cannot be distinguished at network level.

Defence: WAF (web application firewall), bot management, rate limiting, CAPTCHA/JS challenges and caching.

Preparation checklist

• Keep DNS with a protected provider; set a low TTL in advance.
• Hide your real server IP; accept only traffic from CDN/WAF IPs.
• Define rate limits for heavy endpoints (search, login, API).
• Cache static content on a CDN.
• Monitoring and alerting: know your baseline of normal traffic.
• A communication plan during attacks: who calls whom?

During an attack

Panicking and changing IPs rarely works. Contact your provider’s NOC, identify the attack type (volumetric or application) and enable the relevant rules. After the attack, examine logs and update root cause and rules.

The Ovabit WAF + CDN package lets you manage both layers from a single panel.

Post-attack report

After every incident, answer these questions: When did the attack begin and when was it noticed? What was peak traffic? Which endpoints were targeted? Which rules worked and which blocked legitimate users? This report cuts response time to minutes in the next attack.

Also record whether the attack came with a ransom demand; if so, notifying the police and keeping an incident record are needed for the legal process.