Every website, game server and API call rides on TCP/IP.
The TCP/IP model is a four-layer stack - link, internet (IP), transport (TCP/UDP) and application. DDoS attacks target different layers; mitigation must match.
7 min read
Link layer (L2): Ethernet, Wi-Fi - moves frames between neighbours on a LAN.
Internet layer (L3): IP assigns addresses and routes packets across networks. Volumetric DDoS floods happen here (UDP/ICMP).
Transport layer (L4): TCP and UDP add ports, reliability or speed. SYN floods and UDP game floods target this layer.
Application layer (L7): HTTP, DNS, SMTP - where proxies and WAFs inspect behaviour.
IPv4 uses 32-bit addresses (e.g. 203.0.113.10); IPv6 uses 128-bit addresses. Routers forward packets based on longest-prefix match in the routing table.
BGP advertises which autonomous system owns which prefix. Protected transit announces your prefix through a scrubbing network before clean traffic reaches your router.
TCP three-way handshake (SYN, SYN-ACK, ACK) establishes state - expensive under SYN flood. UDP has no handshake - easy to spoof source IPs for amplification.
Operators harden TCP with SYN cookies and rate limits; UDP requires protocol-specific filters and source validation at the edge.
TCP/IP is a practical four-layer model used on the internet. OSI has seven layers but maps similarly - L3≈network, L4≈transport, L7≈application.
Different attack types live at different layers. Volumetric floods are L3/L4; HTTP floods are L7. Effective protection filters at each layer you expose publicly.
TMW Shield mitigates L3–L7 with BGP-routed scrubbing, game UDP profiles and L7 proxy options.