Terabit-scale Distributed Denial of Service (DDoS) attacks have become an increasingly important challenge for network operators. As internet connectivity speeds increase and attackers gain access to larger distributed botnets, DDoS attacks can generate traffic volumes measured in terabits per second (Tbps), placing significant pressure on network infrastructure.
For Internet Service Providers (ISPs), hosting providers and data centres, these attacks create a fundamental infrastructure challenge: malicious traffic can exceed the capacity of individual network connections before it reaches local DDoS filtering systems.
Mitigating attacks of this magnitude requires more than a powerful filtering appliance. Network operators must consider where attack traffic enters their infrastructure, how quickly mitigation is activated and whether sufficient network capacity exists at the locations responsible for handling the traffic.
This article focuses primarily on volumetric network-layer attacks and explains how terabit-scale DDoS attacks work, why they are difficult to mitigate and how technologies such as upstream filtering, BGP FlowSpec, Remote Triggered Black Hole (RTBH) routing, external scrubbing centres and high-performance inline filtering can form a scalable protection architecture.
What Is Terabit-Scale DDoS Mitigation?
Terabit-scale DDoS mitigation describes protection against attacks generating traffic measured in terabits per second.
One terabit per second equals 1,000 gigabits per second (Gbps). To put this into perspective, an attack reaching 1 Tbps represents ten times the traffic capacity of a 100 Gbps network connection.
| Attack bandwidth | Equivalent in Gbps |
|---|---|
| 100 Gbps | 100 Gbps (0.1 Tbps) |
| 500 Gbps | 500 Gbps (0.5 Tbps) |
| 1 Tbps | 1,000 Gbps |
| 5 Tbps | 5,000 Gbps |
| 10 Tbps | 10,000 Gbps |
When discussing terabit-scale attacks, it is important to understand that reported bandwidth figures typically represent peak aggregate traffic rates. An attack described as reaching 10 Tbps does not necessarily sustain that rate throughout its duration, nor does it mean all traffic passes through a single network connection. Attack traffic may be distributed across multiple interfaces, routers and network locations.
A network receiving an attack of this size needs enough capacity to carry or absorb the traffic until it can be filtered.
In practice, terabit-scale mitigation often involves multiple high-capacity routers, upstream filtering systems or geographically distributed DDoS scrubbing centres.
The total mitigation capacity of such an infrastructure may be spread across numerous devices or network locations rather than provided by one appliance.
It is also important to distinguish between mitigation capacity and network bandwidth. A provider may operate several terabits of aggregate infrastructure capacity, but that does not necessarily mean the same capacity is available on every customer connection or at every network location.
For example, a provider advertising 10 Tbps of aggregate network capacity may still experience congestion if attack traffic is concentrated on a particular upstream connection or point of presence with significantly less available bandwidth.
Effective mitigation therefore depends not only on total capacity, but also on network topology, peering arrangements, traffic distribution and where filtering is applied.
How Do Terabit-Scale DDoS Attacks Work?
Terabit-scale DDoS attacks are typically volumetric attacks designed to overwhelm network bandwidth or processing resources with large amounts of unwanted traffic.
Attackers may use compromised devices, distributed botnets or internet services that can be abused to generate traffic towards a target.
Common attack methods include:
- UDP floods: Large volumes of UDP packets sent towards a target network or service, consuming bandwidth and potentially overwhelming packet-processing resources.
- Reflection and amplification attacks: Attacks that abuse third-party services to send substantial amounts of traffic towards a victim, sometimes generating more response traffic than the attacker originally transmitted.
- TCP floods: Large volumes of TCP packets, including SYN floods, designed to overwhelm network bandwidth, packet-processing resources or connection-handling systems.
- Multi-vector attacks: Attacks combining different techniques or traffic patterns to challenge multiple parts of the protection infrastructure.
A terabit-scale attack does not necessarily require a single source capable of generating enormous amounts of traffic. Instead, traffic can originate from many distributed sources simultaneously.
Attack duration also varies. Some attacks are sustained over longer periods, while others arrive in short bursts that can disrupt services before manual mitigation procedures are completed.
Terabit-scale DDoS attacks have evolved from relatively unusual events into a recurring challenge for large network operators. Improvements in internet connectivity, the availability of compromised high-bandwidth devices and the use of distributed attack infrastructure have increased the potential scale of volumetric attacks.
Although the frequency and intensity of these attacks vary, network operators must increasingly consider the possibility of traffic volumes that exceed the capacity of individual connections, routers or filtering systems.
Why Are Terabit-Scale DDoS Attacks Difficult to Mitigate?
The main challenge with terabit-scale attacks is that malicious traffic can exceed the capacity of network connections and security infrastructure before it can be filtered.
Network Bandwidth Limitations
Consider a hosting provider with a 100 Gbps upstream connection.
If an attacker generates 1 Tbps of traffic towards the provider's network, the incoming traffic demand is ten times greater than the connection's nominal capacity.
Even if the hosting provider operates a powerful DDoS filtering appliance, that appliance cannot process packets that fail to reach it because the upstream connection is already congested.
This is why the location of DDoS mitigation infrastructure is critical.
Filtering attack traffic at an upstream router or external scrubbing centre can prevent malicious packets from consuming the bandwidth of the protected network's connection.
High Packet-Processing Requirements
Bandwidth is not the only challenge.
DDoS attacks can also generate enormous numbers of packets per second, placing pressure on routers, firewalls and packet-filtering systems.
Two metrics are particularly important:
- Gbps or Tbps: The amount of network traffic a system can process.
- Mpps or Gpps: The number of packets processed per second, measured in millions or billions.
A system may process very high bandwidth when packets are relatively large but struggle with smaller packets that require more processing operations per second.
For a detailed explanation of this relationship, read our guide to line-rate DDoS filtering and high-speed packet processing.
Mitigation Infrastructure Can Become a Bottleneck
Even when sufficient network bandwidth is available, filtering systems have their own performance limits.
These may include packet-processing capacity, supported filtering rules, hardware resources and the available throughput of the underlying network interfaces.
For this reason, terabit-scale DDoS protection must be designed around the capabilities of the complete network architecture rather than the advertised performance of a single device.
How Networks Mitigate Terabit-Scale DDoS Attacks
There is no single mitigation technique suitable for every terabit-scale attack.
High-capacity networks commonly use a combination of upstream traffic filtering, BGP blackhole routing, external scrubbing, distributed mitigation infrastructure and local filtering systems.
The appropriate approach depends on network architecture, the type of attack and the operational requirements of the protected services.
1. Upstream DDoS Filtering
One approach is to block malicious traffic at upstream routers before it reaches the protected network's more limited connections.
Network operators can use filtering rules to identify unwanted packets based on characteristics such as destination IP addresses, network protocols and ports.
BGP FlowSpec is one mechanism for distributing these rules to compatible routers.
For example, when a DDoS detection system identifies a UDP flood matching specific traffic characteristics, it can generate a FlowSpec rule instructing compatible routers to drop or rate-limit matching packets.
If the router supports the rule in its hardware forwarding plane, it may enforce the filter at line rate.
This enables malicious traffic to be discarded directly within capable network infrastructure, potentially before reaching the protected customer's connection.
However, BGP FlowSpec does not provide unlimited mitigation capacity. Performance depends on router hardware, supported rule types and where filtering is applied.
Network operators must also consider rule validation and filtering policies. Incorrectly configured or overly broad FlowSpec rules can discard legitimate traffic, making appropriate safeguards and controlled automation important.
2. Remote Triggered Black Hole (RTBH) Routing
Remote Triggered Black Hole (RTBH) routing is another widely used technique for mitigating volumetric DDoS attacks.
RTBH allows network operators to instruct participating routers to discard traffic destined for a specific IP address or network prefix. This is commonly implemented through BGP route announcements using predefined blackhole communities.
When a destination is experiencing a DDoS attack, an RTBH announcement can cause traffic towards that destination to be dropped at designated points within the network or by participating upstream providers.
This can prevent attack traffic from consuming bandwidth deeper within the protected network and limit the impact on other customers or services sharing the same infrastructure.
RTBH is relatively simple to implement, can be automated and is supported by many network operators and transit providers.
Its main trade-off is that destination-based blackholing generally discards legitimate traffic alongside malicious traffic for the affected destination.
However, this behaviour can be appropriate for certain operational scenarios. For example, a hosting provider may choose to blackhole an attacked destination temporarily to preserve network stability and maintain connectivity for other customers.
The effectiveness of RTBH depends on where the blackhole route is applied. If filtering occurs only after traffic has already crossed a congested upstream connection, it will not resolve congestion on that connection.
For this reason, RTBH is most effective when blackhole routing can be activated at suitable upstream or network-edge locations.
RTBH can operate alongside more selective mitigation methods such as BGP FlowSpec and traffic scrubbing, giving network operators different options depending on the attack characteristics and protection requirements.
3. External DDoS Scrubbing Centres
External scrubbing centres provide additional mitigation infrastructure for networks facing attacks that exceed their local capacity.
When an attack is detected, traffic destined for an affected network prefix can be redirected towards a scrubbing provider.
The provider receives incoming traffic, filters malicious packets and forwards legitimate traffic back to the protected network through an established return path.
This means unwanted traffic can be discarded before reaching the customer's bandwidth-constrained connection.
Scrubbing centres may operate high-capacity infrastructure across multiple locations, allowing large attacks to be handled outside the protected network.
Some providers offer always-on scrubbing, where protected traffic continuously passes through their infrastructure. Others support on-demand diversion, where traffic is redirected only when mitigation is needed.
FastNetMon supports automated traffic diversion through BGP-based mechanisms and integrations with external scrubbing providers.
For a detailed explanation, see DDoS Scrubbing Centre Automation: How On-Demand Traffic Diversion Works.
4. Distributed DDoS Mitigation Infrastructure
Another important element of terabit-scale mitigation is distributing protection capacity across multiple network locations.
Rather than relying on one filtering appliance or a single internet connection, a distributed architecture can use multiple routers, filtering systems and scrubbing facilities to handle attack traffic.
For example, a large network operator may have several points of presence (PoPs), each with high-capacity connections and mitigation capabilities.
Traffic can be filtered at different locations according to the operator's routing and mitigation policies.
This can reduce dependence on one network location and allow the available mitigation capacity to be used more effectively.
However, distributed capacity does not automatically guarantee that every attack can be handled. The ability to absorb traffic depends on how the attack is distributed, routing behaviour and capacity at the locations receiving it.
5. Local Inline DDoS Filtering
Inline DDoS filtering systems operate directly within the protected network's traffic path.
They inspect incoming packets, apply filtering rules and discard traffic matching malicious patterns while forwarding permitted traffic.
Inline systems can use specialised networking hardware or high-performance software running on commodity servers.
This approach gives network operators control over local traffic filtering and can reduce the amount of unwanted traffic reaching internal infrastructure.
However, local filtering cannot prevent congestion on upstream connections that have already been saturated.
For this reason, inline DDoS filtering is often most effective as one layer of a broader protection architecture, alongside upstream filtering or external scrubbing capacity.
Conclusion
Terabit-scale DDoS attacks present significant challenges for network operators because attack traffic can exceed the bandwidth and packet-processing capacity of individual systems.
Effective mitigation requires more than a high-throughput filtering appliance. It depends on sufficient network capacity, the ability to filter traffic before it reaches constrained links and reliable coordination between the different layers of protection.
Upstream filtering, BGP FlowSpec, RTBH, external scrubbing centres, distributed mitigation infrastructure and local inline filtering all provide useful capabilities for different mitigation scenarios.
By combining automated attack detection with appropriate mitigation infrastructure, network operators can reduce their exposure to large-scale attacks while maintaining network stability and, where the selected mitigation approach permits, continued access for legitimate users.
