PacketStream DDoS mitigation is organized into per-layer filters. Volumetric attacks at L3/L4 are blocked by Smart-RateLimit, packet authentication, and multiple filters; application-layer attacks at L7 are blocked by protocol- and application-specific verification filters.

1. Layer 3/4 DDoS Protection

Attacks at L3/L4 are detected and blocked by Smart-RateLimit, packet authentication, and many filters. The main filters are listed below, and dozens more run alongside them.

Key L3/L4 Filters

• IP RFC-Validation Filter — Verifies whether each packet complies with RFC specifications to identify and block abnormal packets.
• IP Smart-RateLimit — Analyzes TCP/UDP traffic to detect and block botnet-based attacks and traffic anomalies in real time.
• UDP AMP Filter — Detects and blocks amplification attacks that exploit UDP protocols such as DNS, NTP, and SSDP.
• TCP SYN-Auth Filter — Applies a 3-Way Handshake authentication step to packets carrying the SYN flag to block abnormal requests.
• TCP Stateful Filter — Tracks the state of every TCP session to block packets that deviate from a normal connection flow.
• Zombie Detection Filter — Identifies and blocks known botnets such as Mirai and Mozi, as well as Zero-Day botnet attacks.

2. Layer 7 Application-layer Filtering

L7 attacks are not blocked by L3/L4 filters, so they are handled by separate application filters. Dedicated L7 filters are available for some major applications, and custom L7 filters can be built in consultation with the technical team.

General L7 Filters

• HTTP Filter — Detects and blocks abnormal requests that do not comply with the HTTP protocol.
• TLS Filter — Verifies the TLS/SSL handshake and session structure to block abnormal connections.
• QUIC Filter — Verifies the initial packet structure and flow of the QUIC protocol to block abnormal traffic.
• RDP Filter — Verifies RDP (Remote Desktop Protocol) connection requests to block abnormal access attempts.
• SSH Filter — Identifies and blocks connection requests that do not comply with the SSH protocol specification.

Game-specific L7 Filters

PacketStream provides L7 filters specialized for major game engines and platforms.

• Raknet Filter — Verifies traffic to Raknet-based game servers. Supported game examples:
  • Rust (Facepunch)
  • Minecraft: Bedrock Edition
  • 7 Days to Die
  • Terraria
• GTA-FiveM Filter — Analyzes FiveM platform-based GTA game server traffic and blocks abnormal connections.
• GTA-AltV Filter — Verifies and protects AltV-based GTA game server traffic.
• ARK: Survival Evolved Filter — Analyzes communication between ARK game servers and clients to block abnormal traffic.
• Minecraft: Java Edition Filter — Analyzes Minecraft Java server protocols to block abnormal connections.
• DayZ (Steam) Filter — Verifies and protects DayZ Dedicated Server and DayZ-based server connection traffic.
• Longvinter (Steam) Filter — Verifies Longvinter Dedicated Server connection traffic and blocks abnormal connections.
• Source Game Engine Filter — Analyzes and protects traffic from Source engine-based game servers (TF2, CS-GO, etc.).
• Arma Reforgers Filter — Verifies Arma Reforgers connection traffic and blocks abnormal connections.
• Palworld Filter — Verifies Palworld connection traffic and blocks abnormal connections.

VPN Protocol Filters

• WireGuard Filter — Analyzes the WireGuard protocol’s initial handshake and communication flow to block abnormal connections.