Your Network's DDoS Defense Doesn't End at Your Border
Most operators think about DDoS defense the same way they think about a firewall: something you configure at your own edge, for your own network, on your own time. That mental model misses half the picture. The peering fabric your network sits inside is itself part of your defense, for better or worse.DDoS attacks keep getting bigger and more common. The networks that handle them best aren't always the ones spending the most on mitigation. They're usually the ones connected to an exchange that gives them built-in advantages and shared tools you just don't get from a single transit provider.
A 60-Second Refresher
A large DDoS attack doesn't have to break in anywhere. All it needs to do is push more traffic at a target than the link or the gear in front of it can handle. That could mean flooding a port, maxing out a router, or filling up a connection so real traffic can't get through.
Why the Exchange Itself Helps
Connecting to an internet exchange changes the DDoS problem in three ways.
First, you get path and capacity diversity. If your network only has one transit pipe, that's one link an attacker can fill up. If you're peering with a bunch of networks at an exchange, your traffic comes in over a lot of different paths.
Second, there's locality. When you exchange traffic right at the IX, it doesn't have to take a long trip out to some far-off transit hub and back. Malicious traffic gets handled close to where it shows up, instead of clogging long-haul links elsewhere.
Third, you get a shared view. The exchange's route servers can see traffic patterns across the whole peering fabric. That helps spot problems early and makes it easier to coordinate a response.
The Tools an Exchange Actually Puts in Your Hands
Those built-in advantages are just part of it. Most exchanges also give you real tools to use when an attack is actually happening.
Remote-triggered blackholing (RTBH) is the main tool for DDoS response at an exchange. If you're under attack, you announce a tagged route,usually for a single IP, to the exchange's route server. The route server tells other members to drop traffic to that IP. It's quick, simple, and you don't have to call anyone. The catch is that the attacked IP goes offline for everyone, not just the attacker. You're sacrificing one host to keep the rest of your network up.
BGP Flowspec is more precise than blackholing. It lets you tell the exchange to drop traffic by protocol, port, or other signatures. For example, you can block a flood of spoofed DNS or NTP responses but let real traffic to that IP through. Most big DDoS attacks use a few common vectors, so filtering by signature can stop the attack without taking the target offline. The limitation is that Flowspec only works if the other members at the exchange are set up to honor it.
There are also newer, more detailed approaches. IXP operators and researchers have been working on automated, machine-learning-based versions of blackholing that try to keep more real traffic flowing during an attack. These are starting to show up more as exchanges look for something between blocking all traffic to an IP and blocking nothing.
Good routing hygiene makes all of this work better. If the exchange is full of spoofable, unverified routes, none of these tools are as effective. Publishing RPKI ROAs and following standard BGP practices, like what MANRS recommends, cuts down on spoofed-source traffic that powers these attacks and makes the exchange's tools work better for everyone.
DDoS for FD-IX Members
If the exchange covers a region like Indianapolis, much of the member traffic can stay local. Bigger port sizes, from 10G up to 100G, give members more room to handle a DDoS burst before their own connection fills up. Your DDoS resilience isn't just about what you have at your own edge. It's also about who you peer with and how well the exchange is run. If you're not sure about your setup, reach out to us.
