What is DDoS protection?
How it works, why you need it, what changed.
DDoS protection sits between your infrastructure and the internet, sorting real users from attack traffic before anything reaches your origin. Modern protection happens automatically, in milliseconds.
How DDoS protection works
Detect
Real-time traffic analysis flags anomalous patterns the moment an attack begins.
Filter
Malicious packets are dropped at our scrubbing centres; clean traffic passes through.
Deliver
Legitimate users reach your origin in under 100 ms - they never notice an attack happened.
Three classes of attack
Volumetric
UDP / ICMP floods, DNS amplification - pure bandwidth saturation. Mitigated by absorbing the flood at our 1+ Tbps edge.
Protocol
SYN floods, Ping of Death, fragmented packet attacks. Caught at the network layer before they exhaust state on your origin.
Application
HTTP floods, Slowloris, low-and-slow attacks targeting application logic. Behavioural analysis distinguishes humans from bots.
What TMW Shield delivers
Layer 3-7
Volumetric, protocol and application-layer mitigation in one stack.
Sub-second response
Detection and filtering before users notice anything.
Always-on
Routed through our scrubbing network 24/7 - not a fire-drill.
5 PoPs worldwide
Mitigate close to the source across Frankfurt, Amsterdam, Zurich, Kansas City and Singapore.
Why operators pick TMW Shield
Real-time mitigation, surgical filtering primitives, and engineers who answer the phone - at every PoP, on every continent we operate in.
Explore TMW Shield- 1+ Tbps mitigation capacity
- Layer 3-7 coverage
- Sub-second detection
- Automatic mitigation
- GEO and ASN filtering
- Edge firewall (stateful)
- Custom rules per service
- 24/7 engineer coverage
TMW Shield vs Cloudflare, Akamai & AWS Shield
How our DDoS protection compares to Cloudflare Magic Transit, Akamai Prolexic, and AWS Shield Advanced.
| Feature | TMW Shield | Cloudflare | Akamai | AWS |
|---|---|---|---|---|
| Contract | Month-to-month | Enterprise contract (Magic Transit) | Enterprise contract (Prolexic) | $3,000/mo min (Shield Advanced) |
| Capacity | 1+ Tbps | Unmetered | 20+ Tbps (Prolexic) | Unmetered (Advanced only) |
| Layer coverage | L3-7 included | L3-7 (Magic Transit + WAF) | L3-4 Prolexic; L7 via App & API Protector | L3-4 Standard; L7 Advanced only |
| ISP / transit protection | Yes - BGP-based | Magic Transit only | Prolexic only | No |
| Activation time | < 1 hour | Hours – days | Days – weeks | Immediate (Standard); days (Advanced) |
| 24/7 human support | All tiers | Enterprise tier only | Enterprise tier only | Premium Support plan required |
DDoS protection FAQ
What is DDoS protection?
DDoS protection detects and absorbs malicious traffic floods before they overwhelm servers or networks, forwarding clean traffic to your origin.
What does DDoS stand for?
Distributed Denial of Service: an attack where compromised devices flood a target so legitimate users cannot reach it.
How does DDoS protection work?
Traffic is rerouted through scrubbing infrastructure via BGP or DNS. Analysis detects abnormal patterns, drops attack traffic, and forwards legitimate traffic.
What is the difference between TMW Shield and Cloudflare DDoS protection?
TMW Shield offers always-on Layer 3-7 mitigation through a BGP-peered network with month-to-month availability and 24/7 engineer access.
What is volumetric attack protection?
It defends against bandwidth-saturating UDP, ICMP, DNS amplification, and NTP reflection floods.
How does AWS Shield compare to TMW Shield?
AWS Shield covers AWS-hosted infrastructure. TMW Shield provides Layer 3-7 coverage for colocation, dedicated servers, VPS, or transit.
What is ISP-level DDoS protection?
It uses BGP route announcements to send traffic through scrubbing before it enters your network, blocking attacks upstream.
Under attack or planning ahead?
TMW Shield mitigates Layer 3-7 attacks with always-on scrubbing and engineers on call.