Line-rate DDoS filtering is the ability to inspect and filter network traffic at the full supported speed of a network connection. For example, a line-rate DDoS filter operating on a 100 Gbps Ethernet interface is designed to process traffic at that speed without becoming a throughput bottleneck, under specified operating conditions.
This capability is particularly important for Internet Service Providers (ISPs), hosting providers and data centres, where DDoS attacks can generate enormous volumes of traffic and millions of packets per second.
But having a high-speed Ethernet connection doesn't automatically mean a device can filter traffic at the same speed. Actual performance depends on packet size, processing capacity, filtering complexity and the underlying hardware or software.
In this article, we'll explain what line rate means, how high-speed DDoS filtering works, and why packet-processing performance is crucial when protecting modern networks.
What Does Line Rate Mean in Ethernet Networking?
In Ethernet networking, line rate refers to the nominal operating speed of a network connection, such as 10 Gbps, 100 Gbps or 400 Gbps.
When a networking device is described as operating at line rate, it means the device can transmit, receive or process traffic at the full supported interface speed under specified conditions.
For example, consider a router with a 100 Gbps Ethernet interface.
The interface can transmit or receive traffic at a nominal rate of 100 gigabits per second. However, the router must also have sufficient processing capacity to handle the packets passing through it.
If its forwarding or filtering system cannot keep up with incoming traffic, packets may be dropped even though the physical interface supports 100 Gbps.
This distinction becomes especially important when the device is responsible for filtering DDoS attacks.
A line-rate Ethernet connection describes network link capacity, while line-rate packet processing describes the ability of a device to handle packets at that speed.
It is also important to distinguish Ethernet line rate from application throughput. Ethernet framing and protocol overhead mean the amount of useful application data carried over a connection is lower than its nominal Ethernet speed.
How Does DDoS Filtering Work?
DDoS filtering is the process of identifying and blocking traffic associated with Distributed Denial of Service attacks while allowing permitted traffic to continue towards its destination.
Network and transport-layer DDoS attacks can involve extremely high volumes of packets, including UDP floods, TCP SYN floods and reflection or amplification attacks.
A DDoS filtering system applies rules based on packet characteristics such as:
- Source and destination IP addresses
- Network protocols, including TCP, UDP and ICMP
- Source and destination ports
- TCP flags
- Packet lengths and fragmentation characteristics
For example, if an attack consists of UDP packets matching a specific destination, port and packet-length pattern, a filtering system may apply a rule to discard packets matching those conditions.
Traffic that does not match a blocking rule can continue through the network, subject to other configured policies.
The effectiveness of this approach depends on how accurately filtering rules identify attack traffic without unnecessarily blocking legitimate users.
Filtering DDoS Traffic Without Creating Bottlenecks
During a DDoS attack, a filtering system may need to process traffic arriving at the full capacity of its network interfaces.
If the system cannot keep up with the incoming packet rate, packets may be lost or processing resources may become overwhelmed.
A high-speed DDoS filter must therefore be able to apply its rules efficiently, even when incoming traffic contains large numbers of packets.
This is the main purpose of line-rate DDoS filtering: maintaining packet-processing performance while enforcing mitigation policies.
Gbps vs Mpps: Why Packet Size Matters
When evaluating DDoS filtering performance, two metrics are particularly important:
Gbps (gigabits per second) measures how much traffic is transmitted or processed.
Mpps (million packets per second) measures how many individual packets a system processes each second.
These metrics are related, but they are not interchangeable.
A network connection carrying large packets requires fewer packets to be processed per second than the same connection carrying very small packets.
For example, a 100 Gbps Ethernet connection carrying minimum-sized Ethernet frames can receive approximately 148.8 million packets per second.
| Ethernet interface speed | Maximum packet rate with 64-byte Ethernet frames |
| 10 Gbps | 14.88 Mpps |
| 100 Gbps | 148.81 Mpps |
| 200 Gbps | 297.62 Mpps |
| 400 Gbps | 595.24 Mpps |
These theoretical rates assume standard minimum-sized Ethernet frames and account for the Ethernet preamble and inter-frame gap.
This matters because DDoS attacks can be designed to generate extremely high packet rates.
A filtering system that successfully processes 100 Gbps of large packets may struggle to process the same bandwidth when packets are much smaller.
Each packet must still be received, classified and subjected to the relevant filtering rules.
Therefore, a 100 Gbps filtering capability does not automatically guarantee line-rate performance for every packet size or attack scenario.
When evaluating DDoS mitigation equipment, network operators should consider both bandwidth throughput and packets-per-second capacity.
How Is Line-Rate DDoS Filtering Achieved?
High-speed DDoS filtering can be implemented using different hardware and software architectures.
The two common approaches are hardware-based filtering and software-based packet processing.
Hardware-Based DDoS Filtering
Many high-performance routers and network switches use specialised hardware, such as Application-Specific Integrated Circuits (ASICs), to process packets efficiently.
These devices can apply supported filtering rules directly in their forwarding hardware instead of processing every packet through a general-purpose CPU.
One way to distribute such rules is through BGP FlowSpec.
BGP FlowSpec enables systems such as FastNetMon to advertise traffic-matching rules to compatible routers, which can then drop or rate-limit matching traffic.
When the rules are supported and enforced by the router's hardware forwarding system, filtering may operate at line rate.
However, BGP FlowSpec itself does not provide line-rate performance. The actual filtering speed depends on the router hardware, installed rules and device capabilities.
For a deeper explanation of router-based mitigation, read our guide to filtering L3/L4 DDoS attacks with BGP FlowSpec and RTBH.
Software-Based DDoS Filtering
High-speed filtering can also be implemented in software using general-purpose servers equipped with suitable network interface cards.
Modern packet-processing frameworks, including DPDK (Data Plane Development Kit) and FD.io VPP (Vector Packet Processing), are designed to reduce processing overhead and handle packets efficiently.
For example, software-based filtering systems can use techniques such as:
- Batch processing: Processing groups of packets efficiently rather than handling each packet independently.
- Optimised memory access: Reducing the overhead associated with accessing packet data and filtering rules.
- Dedicated processing cores: Allocating CPU resources to packet processing rather than relying on general-purpose operating system network handling.
- Efficient packet classification: Organising filtering rules to minimise the work required to determine whether packets should be permitted or dropped.
These techniques can enable high packet-processing rates on commodity hardware, although performance depends on the server, network interfaces, filtering rules and software configuration.
For readers interested in the engineering behind software-based filtering, Denys Haryachyy explores these principles in Learning VPP: Filtering Packets at 100GbE Line Rate.
Line-Rate DDoS Filters vs Line-Rate DDoS Scrubbers
The terms line-rate DDoS filter and line-rate DDoS scrubber are closely related, but they are not necessarily identical.
A line-rate DDoS filter focuses on applying traffic-filtering rules at the full supported network interface speed. This may involve dropping packets that match specific attack characteristics.
A line-rate DDoS scrubber describes a broader traffic-cleaning system capable of applying its supported mitigation policies and forwarding permitted traffic at network speed.
In practice, the terms can overlap because filtering is a fundamental part of DDoS scrubbing.
Both approaches depend on sufficient processing capacity to handle the incoming traffic. However, a system's ability to perform simple packet filtering at line rate does not necessarily mean it can perform every type of advanced traffic inspection at the same speed.
This distinction is particularly important when comparing DDoS mitigation solutions with different filtering capabilities and performance claims.
Line-Rate DDoS Filtering with FastNetMon and FastACL
FastNetMon provides real-time DDoS detection and automated mitigation capabilities for network operators. Depending on the deployment, it can trigger filtering rules on compatible routers through BGP FlowSpec or integrate with other mitigation infrastructure.
With FastACL, the FastNetMon ecosystem also includes a high-performance inline packet filtering engine.
FastACL Community is an open-source filtering engine built as a native plugin for FD.io VPP. It is designed to process traffic directly in the network path, dropping packets that match configured filtering rules while forwarding permitted traffic.
FastACL supports packet filtering based on characteristics including IP addresses, ports, protocols, TCP flags and packet lengths.
Performance is a central part of its design.
In published tests using a single AMD EPYC 7742-based platform, FastACL achieved:
- 270 million packets per second (Mpps) when processing 64-byte packets.
- 400 Gbps throughput across two 200 GbE interfaces using medium-sized packets.
These results illustrate the potential of high-performance software filtering on commodity hardware.
They also demonstrate why packet size matters: a system may reach the full advertised throughput of its interfaces with larger packets while achieving a different result with minimum-sized packets.
Actual filtering performance depends on the deployed hardware, traffic characteristics, rule configuration and test conditions.
FastACL provides the inline packet-filtering data plane, while FastNetMon can provide attack detection and mitigation orchestration as part of the overall protection architecture.
What Should You Look for in a Line-Rate DDoS Filtering Solution?
When evaluating high-speed DDoS filtering systems, network operators should consider more than the advertised Ethernet interface speed.
Important questions include:
Can the system process traffic at the full interface speed?
Look for documented throughput measurements that reflect realistic filtering workloads.
What is the maximum packet-processing rate?
Evaluate performance in Mpps, particularly with minimum-sized packets that place greater demands on the processing system.
How does performance change when filtering rules are enabled?
A system's basic forwarding throughput may differ from its performance when complex filtering policies are active.
What filtering capabilities are supported?
Check whether the system can match the packet characteristics needed to mitigate the attacks relevant to your network.
How does the solution integrate with existing infrastructure?
Consider compatibility with routers, network interface cards, monitoring systems and mitigation automation tools.
Where is filtering performed?
Filtering on a local server or appliance cannot recover bandwidth already saturated on an upstream link. Some attacks may require upstream mitigation or diversion to an external DDoS scrubbing provider.
These considerations help distinguish theoretical interface capacity from practical DDoS mitigation performance.
Conclusion
Line-rate DDoS filtering enables network operators to block malicious traffic while processing packets at the full supported speed of their network connections.
Whether filtering is implemented through specialised router hardware or high-performance software, the underlying challenge is the same: applying mitigation policies efficiently enough to keep pace with incoming traffic.
Understanding the difference between Gbps and Mpps is essential, particularly when protecting networks against attacks involving large numbers of small packets.
With FastNetMon's automated DDoS detection and mitigation capabilities and FastACL's high-performance inline filtering engine, network operators have multiple options for building DDoS protection architectures around their existing infrastructure.
Learn more about FastACL Community and its packet-filtering capabilities or explore FastNetMon's DDoS detection and mitigation solutions.
