Every DDoS protection spec worth reading carries two numbers, such as "40 Gbps / 4 Mpps": bandwidth in gigabits per second, and packet rate in millions of packets per second. It is easy to read the first and skip the second, yet for many floods the second runs out first. This guide works through gbps vs mpps with the arithmetic shown: how to convert one into the other, which limit each NexonHost tier reaches first, and what to ask a provider that quotes only one.
Two meters for two kinds of work
Bits per second measure volume. Send more bits than the uplink, or the filtering in front of it, can carry, and the attack wins by congestion.
Packets per second measure work. Every packet, whatever its size, has to be read, checked against filter rules and forwarded or dropped, and routers and scrubbers have a per-second budget for that work. RFC 2544, the IETF's benchmarking method for network devices, tests with an almost-empty 64-byte frame to help measure per-frame processing overhead.
Cloudflare's DDoS threat report for the first half of 2026 notes that attackers sometimes pair a high packet rate with low bandwidth, or the reverse, to hit network gear and bandwidth separately. It defines its largest attacks on three axes: above 1 Tbps, 1 billion packets per second, or 1 million HTTP requests per second.
The arithmetic: what one packet costs on the wire
On the wire, every Ethernet frame costs more than its own size. RFC 5180 gives the maximum frame rate as:
frames per second = line rate ÷ (8 × (frame size + 20 bytes))
The 20 bytes are an 8-byte preamble and a 12-byte inter-frame gap. The smallest Ethernet frame is 64 bytes. The largest untagged one is 1,518 bytes: a full 1,500-byte IP packet, the most RFC 894 allows over Ethernet, plus 18 bytes of header and checksum.
- Minimum frames: 64 + 20 = 84 bytes = 672 bits. 10,000,000,000 ÷ 672 = 14,880,952 packets per second on a 10 Gbps link.
- Full-size frames: 1,518 + 20 = 1,538 bytes = 12,304 bits. 10,000,000,000 ÷ 12,304 = 812,743 packets per second.
Same pipe, 18.3 times the packets. Reversed, it gives the conversion a DDoS spec needs: 1 Mpps of minimum frames is 1,000,000 × 672 bits = 0.672 Gbps; of full-size frames, 12.3 Gbps.
| Frame size | On the wire | Packets/s at 10 Gbps | Gbps at 1 Mpps |
|---|---|---|---|
| 64 bytes (minimum) | 84 bytes | 14,880,952 | 0.672 |
| 512 bytes (mixed flood) | 532 bytes | 2,349,624 | 4.256 |
| 1,518 bytes (full-size) | 1,538 bytes | 812,743 | 12.304 |
The rates match RFC 5180's 10 Gb/s table. A mix averaging 512 bytes behaves like the middle row.
One formula for any tier
For a tier of G Gbps / M Mpps, the two limits meet where packets average:
crossover = G ÷ M × 125 bytes on the wire
That is G × 1,000,000,000 bits ÷ (M × 1,000,000 packets × 8). Smaller packets exhaust the Mpps limit first; larger ones the Gbps limit.
Take the 20 Gbps / 1 Mpps included with every NexonHost VPS. Its crossover is 20 ÷ 1 × 125 = 2,500 bytes, larger than any standard Ethernet frame. A 64-byte SYN flood reaches 1 Mpps at 0.67 Gbps, a full-size flood at 12.3 Gbps; filling 20 Gbps would take 1.63 Mpps (20,000,000,000 ÷ 12,304). On that tier, any flood reaches the packet figure first.
Which limit runs out first on each tier
On paper, each cell names the limit a flood reaches first, and where the other meter stands then. Crossovers are bytes on the wire (counting IP bytes instead flips no cell); the last six rows are dedicated server tiers.
| Tier (crossover) | 64-byte flood | 512-byte mix | 1,518-byte flood |
|---|---|---|---|
| VPS 20 Gbps / 1 Mpps (2,500 B) | Mpps, at 0.67 Gbps | Mpps, at 4.3 Gbps | Mpps, at 12.3 Gbps |
| VPS 100 Gbps / 10 Mpps (1,250 B) | Mpps, at 6.7 Gbps | Mpps, at 42.6 Gbps | Gbps, at 8.1 Mpps |
| 40 Gbps / 4 Mpps (1,250 B) | Mpps, at 2.7 Gbps | Mpps, at 17.0 Gbps | Gbps, at 3.3 Mpps |
| 80 Gbps / 6 Mpps (1,667 B) | Mpps, at 4.0 Gbps | Mpps, at 25.5 Gbps | Mpps, at 73.8 Gbps |
| 100 Gbps / 8 Mpps (1,563 B) | Mpps, at 5.4 Gbps | Mpps, at 34.0 Gbps | Mpps, at 98.4 Gbps |
| 200 Gbps / 16 Mpps (1,563 B) | Mpps, at 10.8 Gbps | Mpps, at 68.1 Gbps | Mpps, at 196.9 Gbps |
| 300 Gbps / 32 Mpps (1,172 B) | Mpps, at 21.5 Gbps | Mpps, at 136.2 Gbps | Gbps, at 24.4 Mpps |
| Up to 1 Tbps / 100 Mpps (1,250 B) | Mpps, at 67.2 Gbps | Mpps, at 425.6 Gbps | Gbps, at 81.3 Mpps |
Two things stand out:
- Small packets are a packet problem on every tier. A 64-byte flood fills the included dedicated tier's 4 Mpps at 2.7 Gbps, under 7% of its 40 Gbps. More Gbps alone does nothing for it.
- Full-size floods split the tiers. The 40 Gbps, 300 Gbps and 1 Tbps tiers and the VPS upgrade reach Gbps first. On 80, 100 and 200 Gbps the packet limit still comes first, by under 2% on the last two.
Which attacks fill which meter
Amplification floods are bandwidth-heavy. The attacker sends small requests, forged with your address as the source, to open UDP services, which send large replies to you. CISA's alert TA14-017A rates the gain as a bandwidth amplification factor, reply payload over request payload: 28 to 54 for DNS, 556.9 for NTP, 56 to 70 for CLDAP, 10,000 to 51,000 for memcached. Large replies push packet sizes up, toward the right-hand columns. They remain current: Cloudflare's H1 2026 report has CLDAP floods up 580% quarter on quarter, the third most common network-layer vector in Q2.
SYN, ACK and small UDP floods are packet-heavy. A SYN normally carries no data, so these packets sit at or near the 64-byte minimum, the left-hand column. DNS can be either: Cloudflare separates a botnet's own query floods from amplified answers, and the two together were 34.3% of network-layer attacks in the first half of 2026.
Packets matter at the very top end, too. Cloudflare's Q4 2025 report classed 384 of the 902 hyper-volumetric attacks in December's "Night Before Christmas" campaign as packet-intensive, against 329 bit-intensive and 189 request-intensive.
Layer 7 is a third meter: requests per second
HTTP floods are counted in requests per second, and the network meters barely register them. Each request comes over a real, usually encrypted connection, so it looks like a visitor. A hypothetical 10,000 requests a second at 1,000 bytes each is 10,000 × 1,000 × 8 = 0.08 Gbps: invisible on a 40 Gbps meter, yet 10,000 page renders a second. Cloudflare's Q4 2025 report recorded a campaign peak of 205 million requests per second.
The protection included with NexonHost VPS and dedicated servers is network filtering at Layers 3 and 4, so requests are the job of the website DDoS protection proxy: SSL support, WAF support, a web challenge for bots and GEO-IP blocking in front of your origin. Remote DDoS protection plans are sized by clean traffic and Layer 4 Gbps, from €49 a month for 3 TB and 10 Gbps. The plan pages publish no requests-per-second ceiling, so ask. Understanding Layer 7 DDoS attacks covers the attack types.
How to read a provider's spec sheet
- Ask for both numbers. A Gbps-only figure hides the limit a small-packet flood finds. Divide one by the other and multiply by 125 to see where the tier tips over.
- Ask what happens above the tier. Practice varies: some providers filter up to the tier and drop the excess, some null-route the attacked address for a time to protect their network, and some move you to a bigger tier. Get the answer in writing.
- Ask when filtering starts. Cloudflare found 90.60% of network-layer attacks in the first half of 2026 ended in under 10 minutes, so protection someone has to switch on can arrive after the attack.
- Ask about Layer 7 separately, in requests per second.
How large a tier you need is a separate question; see How much DDoS protection is enough for a dedicated server and the 2026 dedicated server DDoS checklist. If an attack is under way now, start with what to do when your server is under DDoS attack.
Choosing a NexonHost tier
Once you read gbps vs mpps as two separate limits, choosing a tier comes down to which column your threat lives in.
- UDP services that answer the public, such as game servers: buy on Mpps, which a small-packet flood exhausts first on every tier. A Linux VPS includes 20 Gbps / 1 Mpps from €9 a month, and the €150-a-month upgrade to 100 Gbps / 10 Mpps gives more packets than the 8 Mpps dedicated tier. Dedicated servers start at €129 a month with 40 Gbps / 4 Mpps included; 8 Mpps is €300 a month more, 32 Mpps €800.
- Bandwidth-heavy floods: against full-size packets, a tier's effective ceiling is the smaller of its Gbps and its Mpps × 12.3: 40, 73.8, 98.4, 196.9, 300 and up to 1,000 Gbps across the six dedicated tiers, at included, €250, €300, €500, €800 and €1,500 a month.
- Websites and APIs: the threat is requests, so put the website protection proxy, from €49 a month, in front of whichever server you run.
Prices are as of 12 October 2026, in euros excluding VAT. Check the product page before you order.
Sources
- RFC 5180 — IPv6 Benchmarking Methodology: section 5.1.1 on 1,518 bytes as the largest untagged Ethernet frame; Appendix A's frame-rate formula, the 20 bytes of preamble and inter-frame gap, and the 10 Gb/s frame-rate table, retrieved 12 October 2026.
- RFC 2544 — Benchmarking Methodology for Network Interconnect Devices: Ethernet test frame sizes (64 to 1,518 bytes, the minimum and maximum the standard permits), the small frame's role in measuring per-frame overhead, and Appendix B's frame-rate table, retrieved 12 October 2026.
- RFC 894 — A Standard for the Transmission of IP Datagrams over Ethernet Networks: the maximum IP datagram on Ethernet is 1,500 octets, retrieved 12 October 2026.
- CISA alert TA14-017A — UDP-Based Amplification Attacks: bandwidth amplification factors for DNS, NTP, CLDAP and memcached (archived, last revised 18 December 2019), retrieved 12 October 2026.
- Cloudflare DDoS Threat Report H1 2026 — hyper-volumetric thresholds, packet-rate versus bandwidth attacks, CLDAP growth, DNS share, attack duration (published 11 August 2026), retrieved 12 October 2026.
- Cloudflare 2025 Q4 DDoS threat report — "Night Before Christmas" campaign attack counts by type and peak request rate (published 5 February 2026), retrieved 12 October 2026.
- NexonHost store configurator — DDoS protection tiers and prices on the Xeon and EPYC dedicated builds, the VPS DDoS option, and the remote protection plan features, retrieved 12 October 2026.
- Computed: wire bits = (frame + 20) × 8; packets per second = line rate ÷ wire bits; Gbps at M Mpps = M × 1,000,000 × wire bits ÷ 1,000,000,000; crossover = Gbps ÷ Mpps × 125 bytes; 14,880,952 ÷ 812,743 = 18.3; 2.688 ÷ 40 = 6.7%; 98.432 ÷ 100 and 196.864 ÷ 200 = 98.4%; 10,000 × 1,000 × 8 = 0.08 Gbps; full-size ceilings = the smaller of Gbps and Mpps × 12.304.
