DDoS isn't one attack — it's a moving spectrum
A volumetric flood at the network layer looks nothing like a low-and-slow HTTP attack. A reflection campaign that amplifies through misconfigured DNS resolvers looks nothing like an IoT botnet sending real-looking GET requests at thousands per second. A SYN flood saturates connection tables; a Slowloris exhausts worker threads. Each needs different telemetry, different thresholds and different mitigation logic.
Most defenses solve part of the spectrum. Cloud scrubbing services absorb volumetric L3/L4 attacks well but force your traffic out of your perimeter. Dedicated on-prem DDoS appliances handle network-layer attacks but require expert tuning and don't see what the application layer is seeing. WAAPs handle application-layer attacks but not the upstream flood that takes the link down before WAAP logic even runs.
TR7 covers both layers on one platform — on your hardware, attached to the vServices that already deliver the application. And the L4 protection learns the topology you're protecting, so the defense gets sharper over time without you becoming a DDoS specialist to maintain it.
Five things that set TR7 DDoS defense apart
Each of these is valuable alone. Together, they redefine what a DDoS defense looks like when it runs on your platform instead of someone else's cloud.
On-prem first — attack traffic stays at your edge
Cloud scrubbing services route your traffic — including the attack — to a third-party network for analysis and filtering. TR7 absorbs and filters at your perimeter, on your hardware. No upstream routing change, no third-party SSL termination, no data residency questions.
L4 and L7 in one platform
Network-layer floods filtered before they reach the application; application-layer attacks stopped at the WAAP layer. No separate dedicated DDoS appliance to deploy, route around or maintain — both layers run on the same platform that delivers your traffic.
Adaptive baseline learning — operator-confirmed
The L4 protection watches your traffic, learns what is normal for your topology — packet rates, source distribution, protocol mix, time-of-day patterns — and presents the baseline it built. You confirm what counts as normal; the defense activates against deviations. Over time it continues to learn as your traffic evolves, so the thresholds stay aligned with reality without manual tuning.
Granular policy — per-vService and per-route-table
L7 protection scopes per vService — different sensitivity for the login endpoint and the static-asset endpoint of the same site. L4 protection scopes per route table — different policy for the customer-facing network and the internal backbone. Granularity is enforced where the application actually lives.
Blocked DDoS never counts toward your bill
Volumetric traffic absorbed by the platform, rate-limited bot floods, dropped amplification packets — none of it counts toward your bandwidth meter. Other vendors charge you for the attacks you successfully blocked, or sell DDoS-cost insurance as an upsell. TR7's bandwidth model already excludes them.
What TR7 DDoS Mitigation includes
Every capability below ships as part of the WAAP platform and attaches to your existing vServices and route tables.
L4 DDoS Protection — network-layer floods
Packet-level filtering against SYN floods, UDP floods, ICMP floods, ACK floods, fragmented packet attacks and connection-state exhaustion. Scopes per route table; absorbs to the throughput your platform can carry.
L7 DDoS Protection — application-layer attacks
HTTP floods (GET and POST), Slowloris, slow POST / R.U.D.Y., recursive GET, cache-busting attacks and application-targeted bot traffic. Real-time behavior analysis with adaptive countermeasures, scoped per vService.
Adaptive baseline learning
Passive observation phase builds a per-topology baseline of normal traffic. Operator reviews the baseline and confirms what counts as normal. Continuous learning thereafter — thresholds re-tune as traffic patterns evolve. No DDoS expertise required to keep the defense aligned with reality.
Amplification and reflection defense
DNS amplification, NTP amplification, SSDP, SNMP, Memcached reflection — common amplifier vectors recognised and dropped before they reach upstream services.
Multi-vector and burst attack handling
Modern attacks shift vectors mid-campaign. The platform tracks the active vector mix and adjusts mitigation accordingly. Short-duration burst attacks, ransom DDoS campaigns and multi-vector IoT botnet floods all handled in the same flow.
Real-time mitigation actions
Drop, rate-limit, challenge (CAPTCHA), throttle or temporary block — chosen per detection. Mitigation engages within the platform's natural inspection path, without rerouting traffic through an external scrubbing service.
Behavior + signature dual detection
Signature-based detection for known attack patterns; behavior-based detection for unknown patterns and slow attacks that signatures miss. Both feed the same mitigation decision.
Content-aware traffic rules
Rate-limit or take conditional action on any traffic attribute — header values, cookie contents, URL parameters, even parsed JSON body values. Configured visually; no scripting language. Useful for API-layer DDoS that targets specific endpoints with specific payload shapes.
Managed signature and threshold updates
Attack signatures, IP reputation feeds and recommended threshold profiles update continuously. Your operators are not the source of updates.
Integration with WAAP signal pipeline
DDoS detection signals feed WAAP policy and vice versa. A source seen abusing one application surfaces immediately in the other's defense logic — one signal, one operations view.
Scoped capacities — small to unlimited
L7 DDoS Protection capacity scopes (1 vService, 10, 100, unlimited) match deployment size. Basic flood detection and rate limiting are included in bundles; advanced behavior-based protection is the add-on.
Full visibility and audit
Every mitigation decision logs to the same console used to manage the vService and the WAAP policy. Investigate an attack from the same place you see traffic, security and delivery.
Attack types defended
TR7 DDoS Mitigation covers the full spectrum of network and application-layer attacks across multiple categories.
Volumetric L3/L4 floods
SYN flood, UDP flood, ICMP/Ping flood, ACK flood, SYN-ACK flood, fragmented packet attacks — packet-level filtering at your platform's throughput limit.
Amplification and reflection
DNS amplification, NTP amplification, SSDP, SNMP and Memcached reflection — recognised by characteristic source-port and packet patterns; dropped before they reach the application.
State exhaustion
TCP connection table exhaustion, NAT state exhaustion, half-open connection floods. Per-route-table scoping prevents one targeted segment from exhausting state for the rest of the platform.
HTTP volumetric
GET floods, POST floods, recursive GET attacks, cache-busting parameter floods. Per-vService scoping; combined with behavior analysis so high-volume legitimate users (e.g. flash-sale customers) are not mistaken for attackers.
Slow application attacks
Slowloris, slow POST / R.U.D.Y., slow read attacks — designed to exhaust server worker threads without sending volumetric traffic. Detected by connection-rhythm analysis, not raw rate.
Encrypted DDoS
HTTPS floods, SSL/TLS renegotiation attacks and ciphertext-only DDoS — mitigated after termination at the platform, so attack patterns are visible to the inspection layer.
Bot-driven volumetric
IoT botnet floods, distributed credential-stuffing campaigns acting as application DDoS, scraper farms generating sustained load. Behavioral bot scoring identifies coordinated automation even when each source IP looks innocent.
Burst, ransom and multi-vector campaigns
Short-duration burst attacks meant to extort response, ransom DDoS notes followed by escalation, multi-vector campaigns that shift between L3/L4/L7 within minutes — tracked as one campaign, mitigated across layers.
Where this outcome shows up
Banking infrastructure under ransom DDoS
Targeted ransom-DDoS notes followed by burst attacks across multiple vectors. On-prem mitigation means no third-party knows you're under attack; adaptive baseline keeps thresholds aligned with the bank's actual traffic rhythm.
E-commerce during flash sales
Legitimate traffic spikes look like attacks; attacks try to hide inside the spike. Per-vService L7 protection with behavior analysis distinguishes flash-sale customers from credential-stuffing bots without blocking real shoppers.
Gaming and real-time service backbones
UDP-heavy traffic with strict latency requirements. L4 protection filters volumetric UDP floods at packet level; the adaptive baseline learns each game server cluster's normal connection rhythm.
Government and public-sector portals
Data residency rules forbid third-party traffic interception. On-prem L4 + L7 mitigation absorbs attacks inside the citizen-data perimeter; audit logs feed the security operations team.
Internal infrastructure protection
VoIP backbones, internal API networks, financial-services backbones. L4 protection scoped per route table keeps a targeted segment from exhausting state for the rest of the platform.
DNS infrastructure under amplification campaigns
Authoritative DNS sees recursive amplification and query floods. TR7's DNS-layer protection drops amplifier-pattern traffic upstream of the DNS service itself.
Features that implement this solution
Capabilities referenced by this solution — the technical pieces that compose the controls described above.
Traffic Quarantine
Observe behavior instead of blocking instantly — isolate sources that exceed a threshold and release them automatically.
Adaptive DDoS Learning
Replace static thresholds with service-aware DDoS protection that learns traffic behaviour and acts on conditions.
Waiting Room
The queue lives on the platform, not in your application — and the capacity is found before the event, not during it.
Rate Limiting
One IP, one account, one API key — you decide which dimension to limit.
Geo/ASN Access Control
Turn country and ASN context into access decisions — without dependency on external services.
IP Reputation Feeds
TR7's central feed, external URL lists and your own exceptions converge in a single IP reputation engine.
DNS Firewall & Application Delivery Controller
Accelerate enterprise DNS traffic and block malicious queries — in a single layer.
L4 DDoS Attack Coverage
Packet-level filtering against SYN/UDP/ICMP flood, amplification, and fragment attacks — with operator-confirmed adaptive baseline.
L7 DDoS Attack Coverage
Per-vService behavioral protection against HTTP flood, Slowloris, R.U.D.Y., and bot attacks — with ddosCond combined conditions.
Common questions
What is the difference between L4 and L7 DDoS protection?
How does adaptive learning work — do I need to be a DDoS specialist?
Does TR7 ship as a separate DDoS appliance?
What capacity can TR7 absorb?
Is the attack traffic ever routed outside my network?
Do blocked attacks count toward bandwidth billing?
How does this integrate with WAAP and the rest of the platform?
DDoS defense that learns your topology — on your platform
Request a live demo of TR7 DDoS Mitigation. We will show the baseline-learning flow, the L4 + L7 attack-type coverage, and how mitigation engages without routing your traffic anywhere external.