Ravi Sir's Cyber Security Cards › Revision Cards
Detection and Defence Stack
Detection and Defence Stack The layers that detect and absorb a DDoS attack: CDN, scrubbing, rate limits and good monitoring. A CDN (like Cloudflare) sits in front and filters traffic. Alerts on sudden traffic spikes let you act fast. “We use a CDN, so we’re 100% safe.” If your origin IP leaks , the
Read card text
What this card says
What it is
The layers that detect and absorb a DDoS attack: CDN, scrubbing, rate limits and good monitoring.
How it works
A CDN (like Cloudflare) sits in front and filters traffic.
Alerts on sudden traffic spikes let you act fast.
Common mistake
“We use a CDN, so we’re 100% safe.”
If your origin IP leaks, the CDN is bypassed. Hide the origin and allow only the CDN’s IPs on the firewall.
| Layer | What | Why |
|---|---|---|
| Monitoring / baselines | bps, PPS, RPS, latency, 5xx rate | You cannot fight what you do not see |
| Border / ISP / cloud scrubbing | Absorb volumetric junk upstream | Origin pipe is small |
| Anycast CDN | Spread attack across many PoPs | Classic large-site pattern |
| WAF / bot management | App-layer floods and scrapers | Cheap HTTP hurts origin |
| Origin rate limits + timeouts | nginx/Apache limits | Last line on your VM |
Learn more in the lesson: 40.7 Detection and Defence Stack