Warden: How it works

When you use our Anti-DDoS solutions, it's important to understand listings and how they are used.

The section explains the purpose and use of whitelisting, greylisting, and blacklisting in Anti-DDoS solutions. Whitelisting allows only trusted IPs, greylisting temporarily blocks potential threats for verification, and blacklisting denies access to known malicious IPs.

These methods help manage and prevent DDoS attacks by filtering traffic based on its origin.

Traffic filtering techniques

Blacklisting

Blocks traffic from harmful or suspicious IP addresses or domains. Once blacklisted, their traffic is automatically denied to prevent attacks from known threats.

Greylisting

Greylisting is only used as a buffer during the authentication period. Warden allows you to connect, even though you are not whitelisted, requiring extra checks before allowing access. Warden will start limiting traffic in a greylist (and dropped) if you are in the middle of a DDoS attack, where traffic from unauthenticated IP addresses can be dropped as a safety measure.

Whitelisting

Creates a list of approved IP addresses or domains allowed to access the network or service. Whitelisted traffic is not rate limited.

How Warden works

Our system verifies the protocol type, determining if it is TCP or UDP. TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

In Anti-DDoS strategies:

• TCP provides reliable, ordered, and error-checked delivery of streams of data between applications. It's essential for ensuring that traffic flows as intended without disruptions.

• UDP offers a simpler transmission model with no handshakes, suitable for time-sensitive communications like gaming or streaming, where speed is prioritized over reliability.

Using Transmission Control Protocol

1. First, Warden will check to see if the player IP address is blacklisted by you. If it is, then they are dropped and denied access to the network.

2. Based on your list of approved IP addresses, Warden will check to see if the player IP address is whitelisted. If it is, then the IP address is approved, and in turn the player is allowed access to the network.

3. If the player IP address is not whitelisted, then Warden verifies if the destination port is allowed. If it isn't, the packet is dropped.

4. If the destination port is valid, then the packet goes through rate-limiting. If the PPS is below the configured threshold, then the packet is allowed. Otherwise, it is dropped.

Using User Data Protocol

1. Warden will check to see if the player IP address is blacklisted. If it is, the player IP address is dropped and denied access to the network.

2. If the player's IP address is already whitelisted, Warden performs bytematching (if enabled in the Armor). There are 2 scenarios that can occur afterwards:

   1. If it passes bytematching, or in the absence of bytematching rules, the packet is allowed into the network.

   2. If the packet fails bytematching, then it is denied access into the network.

3. If the player's IP is not whitelisted, Warden verifies if the destination port is allowed. If it isn't, the packet is dropped.

4. If the destination port is valid, then Warden performs bytematching (if enabled in the Armor).

   1. If the packet fails bytematching, then it is denied access into the network.

   2. If it passes bytematching, and if the packet per second is below the configured threshold, then the packet is allowed to enter the network.