> ## Documentation Index > Fetch the complete documentation index at: https://docs.gcore.com/llms.txt > Use this file to discover all available pages before exploring further. # About DDoS Protection > Gcore DDoS Protection offers free Basic and paid Advanced modes, comparing detection speed, traffic coverage, attack types, and pricing. Gcore DDoS Protection safeguards networks, servers, and instances against distributed denial-of-service (DDoS) attacks. Two protection modes are available: Basic (free, enabled by default) and Advanced (paid, always-on filtering via a Threat Mitigation System (TMS)). > [!NOTE] > > This article covers Basic protection for Gcore-hosted resources and Advanced protection for customer networks onboarded through Generic Routing Encapsulation (GRE). Basic protection is applied automatically to all Gcore-hosted resources with no enrollment required. Advanced protection is a paid service activated through the GRE-based onboarding flow. > > Bare Metal servers and dedicated servers are not covered here; they use separate procedures with different specifications and pricing: > > * [Advanced DDoS Protection for Bare Metal servers](/cloud/bare-metal-servers/advanced-ddos-protection/activate-advanced-ddos-protection-for-bare-metal-servers) > * [DDoS protection for dedicated servers](/hosting/other-services/ddos-protection/about-gcore-ddos-protection-for-dedicated-servers) ## Protection modes The two modes differ in detection speed, traffic coverage, and cost. | Feature | Advanced protection | Basic protection | | - | - | - | | Pricing model | Paid | Free | | Attack detection time | Under 1 second | 3 minutes | | Attacks it protects from | Common amplification attacks, IP spoofing attacks, volumetric attacks (L3), connection attacks (L4), application-layer attacks (L7) | Common amplification attacks, IP spoofing attacks | | Protection technology | 1. All network traffic passes through TMS. 2. In case of an attack, TMS immediately filters the traffic. 3. TMS forwards legitimate traffic to the protected network. | 1. Attack is detected. 2. The attacked IP is null-routed for 12 hours. | | Best for | Networks attacked frequently, networks hosting services that require continuous availability, or use cases where application-layer (L7) attacks are a concern | Networks rarely attacked, or where short-term unavailability during an attack is acceptable | > [!NOTE] > > Detection times apply to network protection. Advanced DDoS Protection for [Bare Metal servers](/cloud/bare-metal-servers/advanced-ddos-protection/about-advanced-ddos-protection-for-bare-metal-servers) and [dedicated servers](/hosting/other-services/ddos-protection/about-gcore-ddos-protection-for-dedicated-servers) detects attacks within 5 seconds. ### Basic protection Basic protection is applied automatically to all Gcore-hosted resources. No additional enrollment or network submission is required. #### Access control list (ACL) rules Basic protection uses predefined ACL rules to block the following traffic types: * Reflection attacks: DNS, NTP, SSDP, MSSQL, LDAP, SNMP, CharGen, Memcache, Echo, RIP, ARMS * Fake source IP attacks: `0.0.0.0/32`, `127.0.0.0/8`, `192.0.2.0/24`, `224.0.0.0/3`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` Volumetric filtering on Basic protection does not apply to floods below 200 Mbit/s per destination IP. To customize ACL rules, upgrade to [Advanced protection](#advanced-protection). #### Null-routing When Basic protection detects a DDoS attack, the system temporarily blocks the targeted IP address. This mechanism is known as null-routing: the targeted IP address is protected from attack traffic but becomes unreachable from the internet for 12 hours. To keep the service available during an attack, upgrade to Advanced protection. ### Advanced protection Advanced protection keeps the TMS active at all times, including when no attack is underway, so filtering starts the moment traffic turns malicious instead of only after an attack begins. Activate Advanced protection in the [Gcore Customer Portal](https://portal.gcore.com) using the self-service setup flow. Start with [service activation](/ddos-protection/onboarding-service/service-activation), which covers plan activation, network submission, Network Operations Center (NOC) review, and network configuration. #### Allowlists IP addresses added to an allowlist are treated as trusted resources. For Enterprise customers, allowlisted IPs bypass DDoS Protection analysis entirely and are not inspected by TMS. For customers on public plans, allowlisted IPs remain subject to DDoS traffic filtering. ## DDoS attack statistics Traffic Analytics in the [Gcore Customer Portal](https://portal.gcore.com/iaas-protection/reports/traffic-analytics) shows live traffic on resources with Advanced DDoS Protection. The **Clean (P95)** value shows the 95th percentile of clean traffic volume, which is used for Advanced protection billing. ![Traffic Overview chart with Inbound, Clean, and Blocked series](https://mintcdn.com/gcore/otKGeKBcC9B3Cubk/images/docs/ddos-protection/about-ddos-protection/traffic-overview.png?fit=max\&auto=format\&n=otKGeKBcC9B3Cubk\&q=85\&s=9f79126060665b3141b0342c1a1251ba) For filters, summary cards, and Advanced Analytics, see [Traffic Analytics](/ddos-protection/traffic-analytics). For the measurement period and billing rules, see [Plan activation](/ddos-protection/onboarding-service/plan-activation). ## Pricing Advanced network protection pricing depends on the plan tier and the data center location. * Plan tier. [Plan activation](/ddos-protection/onboarding-service/plan-activation) lists the available tiers — pay as you go (PAYG), Start, Pro, and Pro+ — based on the clean traffic volume and number of network prefixes to protect. * Data center location. Prices vary by data center. Contact the [Gcore sales team](mailto:sales@gcore.com) for pricing at a specific location. Every tier covers L3–L7 attacks by default. For custom configurations, contact the Gcore sales team to request a tailored plan. For Bare Metal and dedicated server protection, pricing depends on the data center location, the traffic capacity, and the protected OSI layers. See [Advanced DDoS Protection for Bare Metal](/cloud/bare-metal-servers/advanced-ddos-protection/about-advanced-ddos-protection-for-bare-metal-servers) and [DDoS protection for dedicated servers](/hosting/other-services/ddos-protection/about-gcore-ddos-protection-for-dedicated-servers) for details.