DDoSInfo

What to do once you have the answer?

If it is an attack: find out, now, who is contractually permitted to trigger mitigation. “Managed”varies wildly. Some contracts let a named engineer on the provider’s side change policy without waking you; others require the customer to raise a ticket and confirm the attack first, which means your protection is only as fast as whoever is asleep with their phone on silent.

How to read a provider’s terabit capacity claim without a lab?

Capacity claims come in three flavours and only one of them affects your uptime. Aggregate network capacity. The sum of everything, everywhere. Marketing number. Per-point-of-presence capacity. More honest, still not yours. Capacity in the region serving your users.

How to verify a provider’s claims before you sign?

A great deal of DDoS and DNS capacity is resold. Ask explicitly whose anycast network it is, whose scrubbing centres handle the traffic, how many points of presence serve UK queries, and whether the party on your contract can change mitigation policy directly or can only raise a ticket with the upstream. The answer to that last question determines your real time to mitigate.