How to Select an Anti-DDoS Plan: Protection Scale, Clean Bandwidth, 95th Percentile, BGP, and SLA

Protection capacity matters, but legitimate traffic must still cross the scrubbing platform, delivery network, and enterprise edge during an attack. If clean bandwidth, the delivery port, a tunnel, BGP, or the customer router is undersized, a large mitigation figure does not guarantee end-to-end service.

A complete comparison includes protection scale, clean bandwidth, delivery port, prefix count, BGP sessions, delivery locations, mitigation policy, reporting, SLA, and support. These fields cover capacity, routing, operations, and incident response.

Protection scale describes the attack volume a plan is designed to process. Clean bandwidth is the legitimate traffic returned after mitigation. Delivery port speed is the physical or logical interface line rate. A plan can therefore provide 100 Gbps of protection, 50 Mbps of clean bandwidth, and a 10G delivery port without contradiction.

If normal enterprise traffic already reaches 300 Mbps, a 50 Mbps clean-bandwidth plan is unsuitable even without an attack. Conversely, a 10G port does not mean that 10 Gbps of legitimate traffic has been purchased. Use monitoring data for average, 95th percentile, peak, and expected growth.

With 95th-percentile billing, traffic is sampled at the interval defined by contract. Samples for the billing period are sorted from highest to lowest; the top five percent are discarded, and the highest remaining sample becomes the billing value. This accommodates brief bursts, but it does not provide unlimited use for five percent of the month, and it does not define whether the service will rate-limit traffic above the commitment.

Confirm where and how traffic is measured: clean inbound delivery, the higher of two directions, or inbound and outbound separately; one-minute or five-minute samples; and whether overage is billed per Mbps, triggers an upgrade, or is limited. These terms belong in the quotation or contract.

A precise commitment states that attack traffic identified and blocked by the protection platform is excluded from clean-bandwidth usage. That is safer than saying all attack traffic is free, because only packets classified and stopped at the scrubbing layer are excluded. Unrecognized anomalies, allowed traffic, or legitimate bursts can still become delivered traffic.

Post-event data should include vectors, blocked traffic, peak bps and pps, destination ports, and event duration. This allows operations teams to validate billing, capacity, and policy. A total-traffic graph without pre- and post-mitigation context is often insufficient.

BGP prefix count describes how many public networks can be onboarded, not how many servers can be protected. One /24 contains 256 IPv4 addresses, but internal allocation and service design remain the customer responsibility. Multiple /24s, ASNs, data centers, or customer networks directly affect plan requirements.

BGP session count affects route exchange and failover. One session suits simple deployments. Two sessions can connect dual routers, delivery paths, or locations, but they provide meaningful resilience only when the devices, line cards, fibers, cross-connects, and failure domains are independent.

First determine whether the SLA measures the scrubbing platform, tunnel, BGP session, local circuit, or end-to-end service. Customer routers, data-center power, configuration errors, planned maintenance, and third-party circuits may be exclusions.

A complete SLA defines availability, measurement, incident start and end, notification, maintenance, exclusions, claim deadlines, and service credits. Critical services should also confirm attack-response time, policy-change authority, and the 24×7 escalation path.

Server Plus Anti-DDoS separates Shield Lite, Pro, Max, and Ultra by protection scale, clean bandwidth, prefixes, sessions, delivery locations, policy, and support. Company headcount is not the sizing method; public-service criticality and measured traffic are.

A useful quote starts with network data rather than company size. Better inputs reduce the risk of normal traffic exceeding the plan or purchasing unnecessary capacity.