Design DDoS Protection

Problem Statement and DDoS Attack Surface

DDoS protection is the discipline of absorbing or filtering attack traffic before it exhausts a finite resource — bandwidth, connection tables, CPU, or origin capacity — while letting legitimate traffic through untouched. The defining constraint, and the first thing to say, is attack-surface layering: volumetric L3/L4 floods (SYN floods, UDP/DNS/NTP amplification) aim to saturate the pipe and are measured in Gbps/Mpps; application-layer L7 floods (HTTP floods, Slowloris) are low-bandwidth but exhaust server resources and look almost like real users. A real design treats these as different problems with different tools — you do not regex an HTTP body to stop a 2 Tbps UDP flood, and you do not blackhole a prefix to stop Slowloris. This is the upstream scrubbing layer the WAF design explicitly deferred to.

The second defining tension is collateral damage: the crudest mitigation (BGP blackhole — drop all traffic to an attacked IP) sacrifices the victim to save the network, so the art is choosing the least-damaging effective response — rate-limit < challenge < scrub-redirect < blackhole — and protecting critical flows (payment webhooks, health checks) with allowlists before any blunt action. Frame success as: detect within seconds, mitigate the largest floods (multi-Tbps) without dropping legitimate users, and never let the mitigation system itself become the outage. Anchor on the players — Cloudflare, AWS Shield, Akamai Prolexic, Google Cloud Armor — and on real scale: the largest recorded floods now exceed 3–7 Tbps and hundreds of Mpps.

Interview checkpoint

Open with the layer split — volumetric L3/L4 (saturate the pipe, Gbps/Mpps, Anycast + scrub) vs application L7 (exhaust the server, looks human, challenge/rate-limit) — because the whole design forks on it. Then name the collateral-damage ladder (rate-limit → challenge → scrub → blackhole) and the rule: pick the least-damaging effective response, allowlist critical flows first.