Skip to Content
DDoS MitigationDDoS Mitigation Routing

PacketStream provides two traffic routing methods.

  • Symmetric — Routes both inbound and outbound traffic through PacketStream.
  • Asymmetric — Bypasses only inbound traffic through PacketStream; outbound uses the existing path.

The difference in the outbound path determines which protection features are available and the cost.

Symmetric Routing Method

Symmetric routing sends both inbound and outbound traffic of the protected network through the PacketStream network. Because outbound traffic is also available, the DMS (DDoS Mitigation System) collects more metadata and identifies and blocks attack traffic more precisely.

Advantages

  • Reduces false positives through bidirectional traffic analysis.
  • Enables advanced defense features such as Adaptive Filtering.

Disadvantages

  • Routing all traffic incurs a corresponding cost.
  • Physical distance and the integration environment with PacketStream must be considered.

Asymmetric Routing Method

Asymmetric routing bypasses only inbound traffic through PacketStream and sends outbound traffic over the existing path (the existing carrier). It is cost-favorable, but because outbound traffic is not analyzed, the accuracy and coverage of some protection features are limited.

Warning Because outbound traffic is not analyzed, detection accuracy for some attacks may be lower.

Considerations

  • Incorrect uRPF (Unicast Reverse Path Forwarding) settings can block legitimate traffic.
  • Configuration is constrained on static-routing-based networks.
  • Advanced protection features such as Adaptive Filtering and Behavioral Analysis are unavailable.

Advantages

  • Existing carrier lines can be kept as they are.
  • Outbound traffic routing costs can be reduced.

Disadvantages

  • Protection accuracy is partially reduced.
  • Understanding of uRPF settings is required.

Choosing a Routing Method

The following are recommended depending on the environment.

When Symmetric Is Suitable

  • Physically close to PacketStream infrastructure, or a cross-connect is available
  • Services that require precise protection (e.g., game servers, financial services, real-time APIs)

When Asymmetric Is Suitable

  • Infrastructure located physically far from PacketStream
  • High outbound traffic ratio, making full traffic bypass costly
  • You need to keep using existing carrier lines (verify in advance whether uRPF policies apply)
DDoS Mitigation ConfigurationIPS/IDS