A packet aimed at your server meets eight places on its way in. Three of them can end it on the host, and each asks a harder question than the last, so the expensive work is only done for traffic that already passed the cheap checks.
On the network, before your server
Floods large enough to fill the link are absorbed here, with 17 Tbps of mitigation capacity that is the same on every plan. You do not configure it and there is no control for it in the panel.
Ends here
The host's 25 Gbit/s card
What the edge let through arrives at the machine that will serve it. Nothing has been allocated for the packet yet.
Nothing is decided here
Clouduxe Prism attaches here
Prism is an XDP/eBPF program attached at the network driver, the earliest point a packet can be inspected: before the operating system allocates a socket buffer, walks its firewall tables or wakes your service up. If protection is paused, every packet passes on from here unfiltered.
Nothing is decided here
The cheapest question
Is this source allowed to talk to this server at all, and is the packet structurally sane? Your deny list is applied here, whichever port the sender aims at. It is the cheapest check there is, so it runs first.
Ends here
Spoofing, state and your ceilings
Is this a real TCP or UDP conversation, or a packet pretending to be one? SYNs whose TCP stack fingerprint looks forged are dropped, and under load an unknown UDP source has its first packet dropped: a real client retransmits, a forged one never does. The packet-rate and connection ceilings on your port rules apply here.
Ends here
Only for traffic that survived the rest
Is this actually the protocol the port claims to serve? A packet aimed at a DNS port is checked against how DNS behaves, not against a generic idea of UDP. The zero-day engine and behavioural scoring work here too.
Ends here
Where ordinary networking begins
Only now does the operating system spend memory and a context switch on the packet. Everything that reached this point was judged to belong to a real client.
Legitimate traffic only from here
Whatever you run: a site, an API, a VPN, a remote desktop
Traffic that passes reaches your service the same way it would with no protection at all: nothing is re-encapsulated and nothing is relayed through another city.
Legitimate traffic only from here
Stops 3 to 6 are Clouduxe Prism, running on your own server at the network driver. Detail on each attack and the stop that ends it is on Attack types.
1
A packet Prism rejects never reaches the network stack. Your server does not spend a context switch on it, so the cost of refusing a flood stays close to flat as the flood grows. Filtering in the host firewall or the application means the packet has already cost most of what it was going to cost.
2
Prism is not a proxy between the internet and your server. There is no second place for your traffic to queue, and no detour through another city.
3
Because it runs on the machine that terminates the connection, the filter reads the real source address and the real payload. A relay often hands your application a proxied source, which hides exactly the information you need when one address is flooding you.
A port rule opens one port, or one contiguous range, on one protocol, and names the service you run there. The service is what tells Prism which checks are possible: which validator runs, which engines apply and which ceilings make sense.
A rule is TCP or UDP, never both, so a service that uses the same port on both, such as DNS on 53 or RDP on 3389, needs two rules. A server holds up to 15 rules, and a saved change reaches the server at its next configuration poll, within about 30 seconds.
Read: Port rulesA port with no rule falls to this setting. Under Allow it stays reachable and gets the always-on protections only; under Deny all it is dropped. The example here uses Deny all.
Closed
growth-sg
203.0.113.40
Default for unlisted ports
Pause protection or change the default to see what it means.
Every port not listed is closed. Nothing reaches the server without a rule. In this example the server's default for unlisted ports is set to Deny all.
The per-connection field stays greyed out until the whole-port ceiling is above zero, and the panel says why right under it. The values shown are the Minecraft (Java) preset's.
Needs a whole-port ceiling above. The datapath only consults this inside that limit, so on its own it is not applied.
In one incident from our documentation, 2,275 established connections pushed 569,000 packets per second through a port whose whole-port ceiling was 5,000. Each connection looked reasonable.
pps_limit. Counted across every source sending to the port, so this is what bounds a flood from thousands of addresses. 0 means no aggregate limit.estab_flow_pps. Applies to one established flow. 0 means the built-in default for that service, not unlimited.Once a connection is established the ceilings treat it as vouched for, so a flood riding open connections can pass under them. Protocol validation catches it, because it checks that the traffic actually speaks the service's protocol and drops what does not.
It is off on a rule you add by hand, on purpose: switching it on beneath a running server could cut off an unusual client or an older client build without warning. Most preset rules arrive with it on. Turn it on when someone can test a connection, not in the middle of an attack.
Read: Protocol validationProtocol validation (L7)
Checks that traffic actually speaks this service's protocol and drops what doesn't.
Catches a flood hiding inside connections that are already open, which the rate limits above cannot see. Turn off if a real client or mod gets dropped.
The service picker marks them. On a service without one the switch has no effect, and the port is covered by the rate limits, layer 3 and layer 4 and the behavioural engines.
| Validator | What it understands |
|---|---|
| DNS | Query and response validation |
| RDP | Remote Desktop |
| VPN | Common tunnel protocols |
| TeamSpeak | Voice, server query and file transfer |
| Game protocols | 4 families: FiveM, Minecraft, Source and rAthena. What each one covers |
| Engine | Runs on | What it does | When to switch it off |
|---|---|---|---|
| TCP fingerprint | TCP rules | Drops SYNs whose TCP stack fingerprint looks forged. | Turn off if a real client behind an unusual NAT, VPN or tunnel is being blocked. |
| Signature (zero-day) | UDP rules | Learns the payload pattern of an in-progress attack and blocks it, without a rule being written first. | Turn off for a service whose legitimate payloads are unusual or highly variable. |
| UDP first-packet challenge | UDP rules on game services | Under load, drops an unknown source's first packet. Real clients retransmit and get through; single-shot spoofed floods never do. | Turn off if real users sharing one address (CGNAT, office or campus NAT) drop out during an attack. |
On a UDP game rule, TCP fingerprint renders dim with the reason. Turn off one engine, only after Address lookup has named it, and give the server about 30 seconds to pick up the change.
TCP fingerprint
Applies to TCP rules. No effect on this one.
Signature (zero-day)
Learns the payload pattern of an in-progress attack and blocks it, without a rule being written first.
UDP first-packet challenge
Under load, drops an unknown source's first packet. Real clients retransmit and get through; single-shot spoofed floods never do.
Under load, an unknown UDP source has its first packet dropped. A real client does what real clients always do and sends again, and from then on its conversation passes. A spoofed flood sends each forged address once and never retransmits, so none of it gets past the first packet.
Sources build up a judgement over time. Completing a genuine handshake counts in their favour, so does answering a challenge, and so does the irregular timing of a human rather than the metronome of a script. A client that has already proved itself keeps priority when pressure rises. An unknown source arriving mid-flood starts from nothing, at the moment the bar is highest.
Signatures only catch attacks someone has already seen. The zero-day engine derives the shape of the attack in progress and refuses traffic matching it, then relaxes when the pattern stops. Nothing has to be written, published or pushed to you first.
Every server has its own filtering state and its own rules: your ports, ceilings, allow and deny lists and your picture of which sources are real. Another customer being attacked does not tighten anything on yours, and a rule you set never leaks outwards.
Paused lets all traffic through unfiltered. The accumulated picture of who is real is part of what holds a server up during an attack, so pause only to troubleshoot, and switch back as soon as you are done.
Each dropped packet is logged with the check that dropped it. The Attacks tab groups those drops into incidents: what the attack was made of, which port it aimed at, and which stop on the path above ended it.
The traffic figures come from exact counters. The breakdowns are built from a sample of the drops, so they show the shape of an attack rather than a count, and the panel marks them with a tilde.
The upstream share first, then each sampled drop reason on the layer that applies it.
Made of Amplification, Protocol impostor and Per-source flood, from 11,420 sources over 6 min 40 s.
of the attack removed upstream, before it reached the server
What reached Prism was then dropped at these stops. Shares are from a sample of the drops, hence the tilde.
Legitimate traffic held between 55 and 62 thousand packets per second for the whole incident.
VPS, VDS or bare metal, in any region: the same 17 Tbps upstream, the same XDP/eBPF filter at the network driver.