Kitsune Technologies · Traffic Scope

DDoS sandbox: where a defense sits decides what it can save

Pick an attack, launch it, and toggle real defenses. Watch three things that usually get lumped together: your uplink, your host CPU, and your application. A firewall on your own box protects the app but the flood already crossed your wire to get dropped. Only a defense that sits upstream of you spares the wire.

AttackL3/4
LEGIT PLAYERS: idle
real players attack / bot traffic
Inbound
0 pps
Uplink / pipe
0%
Host CPU
0%
App / players
0%
Defenses
Briefing

The three bars, and why they move separately

A flood is not one problem. It lands on three resources in sequence, and each defense only touches some of them.

Your uplink is the wire from your ISP. Once packets are on it, they already spent that bandwidth. Nothing you run at home can un-spend it, because the congestion is upstream of your front door.

Your host CPU pays to look at every packet, even the ones it drops. A kernel firewall rule that discards a flood still ran once per packet. At a few hundred thousand packets a second that is a real bill.

Your application is the game server or web app. This is the one an in-host allowlist or a WAF actually protects, by refusing the junk before your code sees it.

Grounded in a real test
191,000 pps

A network-namespace lab: one honest player, one UDP flood of spoofed sources, an nftables allowlist that only trusts sources with a sustained session. The sentinel flipped to allowlist-only within a fraction of a second.

< 1 s
to detect + flip
~0
flood reached app
~5 s
player still lost

The allowlist did its job at the app, yet the player still dropped out. The flood kept arriving at the host, and the CPU spent to inspect and drop it starved the game. In-host filtering protected the application, not the machine. That gap is the whole reason the upstream defenses exist.

Things you can build from this

Edge allowlist for game servers

The lab technique, productized: a small agent in front of Minecraft or Source servers that promotes real sessions and drops everyone else during a spike. Buys time and stops L7 and session floods. Pair it with an upstream front for volume.

DDoS-protected hosting plans

Put customer game and web servers behind a filtered upstream (anycast scrubbing or a filtered VPS front with a tunnel home). The customer never exposes their origin, and volumetric floods die before the wire. This is a plan feature you can charge for.

Private-by-default dev and staging

Most servers that get hit never needed to be public. A tailnet (WireGuard) puts dev and staging on private addresses, so there is nothing on the public internet to flood. Free, and it closes the most common way small teams get knocked over.

The honest short version: an allowlist or a WAF is a real layer, and it is enough when the attack is not about raw volume. The moment it is about volume, the fight has to happen upstream of your pipe, because your pipe is the thing being filled.

Built by Kitsune Technologies · build 2026-07-03c. The numbers in the meters are a teaching model; the 191,000 pps anchor is from a real isolated lab run. Nothing here attacks anything real.