Carpet Bombing DDoS: Why Per-IP Thresholds Miss It

Most DDoS detection was built to watch addresses one at a time: when traffic to one IP crosses a threshold, filtering starts. A carpet bombing DDoS attack slips under that by spreading one flood across many addresses in a prefix, such as a whole /24, so no address looks attacked while the total fills the links they share. If you rent a /24, bring your own prefix or host many customer IPs, your protection has to see this. Below: the arithmetic, what detects it, and what to ask.

What a carpet bombing attack is

NETSCOUT's ASERT team says it began seeing attacks aimed at entire CIDR blocks, instead of single addresses, in 2016. Its February 2024 post gives other names (spread spectrum, subnet DDoS) and the purpose: to stay under per-host packet-rate or bit-rate thresholds and hide which address the attacker wanted down.

Akamai's March 2023 review of 2022 uses a broader term: horizontal attacks, aimed at multiple, unrelated targets at once, "sometimes called carpet bomb attacks". The record-breaking attack it wrote about in September 2022 hit 1,813 IP addresses across six physical data centres.

NETSCOUT says almost all carpet bombing it has seen uses well-known reflection and amplification vectors such as DNS, NTP and TCP (DNS amplification attacks explains reflection). What differs is the targeting.

Don't confuse it with the 7.3 Tbps attack Cloudflare reported for mid-May 2025, which it says carpet-bombed an average of 21,925 destination ports on a single IP. That spreads across ports, not addresses.

How often it happens

NETSCOUT's figures, dated because they drift:

Its April 2023 threat report release said carpet bombing rose 110% from the first to the second half of 2022, mostly against ISP networks.
Its February 2024 post said its reflection honeypots see an average of 6,000 a day, a count it calls conservative because it considered only non-TCP reflection.
On average an attack hit hundreds of hosts; one hit 8,000 IPv4 addresses. 90% lasted one minute.

The threshold arithmetic

A /24 holds 2⁸ = 256 addresses. Classic subnetting reserves two, leaving 254 usable hosts (/24 vs /27 explains why), but an attacker aims at the prefix, so count all 256.

As an illustration, suppose per-IP detection triggers at T = 1 Gbps (a made-up figure, not NexonHost's). At 0.4 × T = 0.4 Gbps per address, nothing trips. The total is 256 × 0.4 Gbps = 102.4 Gbps.

A 1 Gbps port: three addresses at 0.4 Gbps already make 1.2 Gbps. The /24 total is 102.4 times the port.
A 10 Gbps uplink: 102.4 ÷ 10 = 10.24 times its capacity.
The 100 Gbps tier included with every NexonHost dedicated server: 2.4 Gbps over, if all 256 addresses count against one server's tier. Ask whether they do (questions below).

The same 0.4 × T on other triggers and ranges (a /22 is 1,024 addresses):

Per-IP trigger (T)	Per address (0.4 × T)	Total on a /24	Total on a /22
100 Mbps	40 Mbps	10.24 Gbps	40.96 Gbps
1 Gbps	0.4 Gbps	102.4 Gbps	409.6 Gbps
5 Gbps	2 Gbps	512 Gbps	2,048 Gbps

A bigger range spreads it thinner: 102.4 Gbps over 1,024 addresses is 0.1 Gbps each, a tenth of the trigger.

Real triggers vary more widely still. At RIPE 77 in 2018, NETSCOUT's Steinthor Bjarnason gave an example SSDP trigger of 4 Mbps per host: 40 Gbps over the 16,384 addresses of a /18 is about 2.4 Mbps each (40,000 ÷ 16,384), so host-based detection does not trigger. At the other end, NETSCOUT's 2024 post says a provider's bandwidth threshold might only trip once a single host receives multiple Gbps. Either way, the aggregate, not the per-IP rate, fills links.

Why per-IP thresholds fail

Bjarnason's 2018 slides say detection systems usually focus on destination IPs rather than subnets, so the attack often goes undetected until too late. Some attacks move: his example hits a /20 inside a /16, switching to another /20 every few minutes.

When per-address alerts do fire, there are too many: NETSCOUT's September 2023 release says hundreds or thousands per attack.

The usual last resort is blackholing, covered in what to do when your server is under DDoS attack: it drops all traffic to the tagged prefix, typically one IPv4 /32 (RFC 7999). Do that for every address in a /24 and the range is offline, finishing the attacker's job.

NETSCOUT notes the intended target may not take the full flood, but the entire netblock can degrade or go down. On a hosting or game provider's range, one customer's enemy can become everyone's outage.

What detects and filters it

Detect per prefix. Bjarnason's advice is to analyse traffic by network block, or by what crosses specific routers, and to classify by destination CIDR when mitigating.
Baseline per block. The slides call for profiling each block's normal volume beforehand, continuously and by time of day and week. RFC 9244, the IETF's DOTS telemetry standard (June 2022), says a baseline's minimum learning period runs from hours to weeks, that it cannot be learned during an attack, and that common global detection thresholds can almost never be realised.
Use flow telemetry. NetFlow v9 (RFC 3954) and IPFIX (RFC 7011) export flow records keyed on fields such as destination address; sFlow (RFC 3176) exports sampled packets. The collector decides whether to sum per address or per prefix.
Filter upstream, by prefix. BGP FlowSpec (RFC 8955) distributes rules over BGP to routers upstream of your port; a rule can match a destination prefix and rate-limit the traffic, or discard it with a rate of zero, so one rule can cover a /24. Bjarnason warned that diverting an entire block such as a /16 will overwhelm most mitigation systems.

Per-IP, prefix-level and upstream filtering compared

Approach	What it sees	Blind spot
Per-IP detection	Bits or packets to each address, against a fixed trigger	Every address under the trigger while the shared link fills
Prefix-level detection	The total for a /24 or larger, against that block's baseline	Needs a baseline learned before the attack; names the block, not the bad packets
Upstream volumetric filtering	Traffic matching rules (protocol, source port, destination prefix), dropped before your link	Attack traffic that looks like real replies (NETSCOUT's example: TCP reflection on broadband networks); capacity if whole large blocks are diverted
Host firewall	Only packets that reached your server	Everything, once the port is full

What it means for your own range

Unused addresses still attract traffic. The internet routes on the announced prefix, so a packet to an empty .200 reaches your provider just as one to your web server does. If the whole /24 is routed to your server, traffic to every idle address that is not dropped upstream lands on your port.
Don't announce more than you use. If you hold a /22 and use one /24, announce that /24. A /24 is also the smallest block to announce: RFC 7999 notes IPv4 prefixes longer than /24 are usually not accepted, as bring your own IP explains.
Monitor the aggregate at your edge. Graph inbound bits and packets for the whole range, summed across servers if it is split. Keep weeks of history, and group per-address alerts by prefix.
Keep an inventory of live addresses and the ports they serve, so you can tell a provider which traffic is legitimate.
Resellers: keep often-attacked customers, such as game servers, in a separate range.

Questions to ask your provider, us included

Is protected capacity counted per address, per server or per prefix? NexonHost's product page says tier upgrades are billed per server, per month; ask how a /24 counts against the 100 Gbps, on one server and split across several.
Does detection watch my whole range's total as well as each address, against a baseline of my traffic or a fixed threshold?
Is my own /24 covered the same way as addresses you assign?
When an attack spans the range, what happens: prefix filtering, diversion, or null routes? For which addresses, how long, and am I told?
Can traffic to addresses I don't use be dropped upstream?
What can I see: per-prefix graphs, flow exports, attack reports?

Get the answers in writing before you put a /24 behind any provider.

Where NexonHost fits

If you hold many addresses, size protection and monitoring for carpet bombing DDoS. Every DDoS protected dedicated server includes 100 Gbps of Layer 4 protection; NexonHost's product page says floods are dropped upstream, before they reach your port, and protection is active from the moment the server is online. Paid tiers run from 500 Gbps at €149 a month to 10 Tbps with Layer 7 at €4,499 a month. A /24 subnet on dedicated servers is €250 a month plus €100 setup; your own /24 is €100 setup, or €200 a month plus €100 setup with your own ASN. Servers start at €129 a month with one IPv4 address and a 1 Gbps unmetered port. Send the questions above before ordering, and start on a one-month term.

Prices as of 26 October 2026, in euros excluding VAT; check the product page before you order.