Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I already have IPTables blocking all unnecessary traffic. Is mod_evasive the best solution for something like this? What do you use on your server?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:22

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 4 down vote accepted

The only real protection from a DDoS can be done at the network layer, upstream of your server. By the time DDoS traffic hits the NIC of your server, it has already passed through multiple pieces of routing and switchgear likely causing some amount of havoc along the way. Even if you block at the host firewall level, your NIC and kernel still need to examine each packet coming in, and depending on the nature of the attack, they may not have a prayer of keeping up with the load compared to the upstream routing gear that would be doing this in hardware.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.