Every DDoS protection spec worth reading carries two numbers: bandwidth in gigabits per second (Gbps), and packet rate in millions of packets per second (Mpps). It is easy to read the first and skip the second, yet for many floods the second runs out first. This guide works through gbps vs mpps with the arithmetic shown: how to convert one into the other, how to work out which limit a tier reaches first, and what to ask a provider that quotes only one.
Two meters for two kinds of work
Bits per second measure volume. Send more bits than the uplink, or the filtering in front of it, can carry, and the attack wins by congestion.
Packets per second measure work. Every packet, whatever its size, has to be read, checked against filter rules and forwarded or dropped, and routers and scrubbers have a per-second budget for that work. RFC 2544, the IETF's benchmarking method for network devices, tests with an almost-empty 64-byte frame to help measure per-frame processing overhead.
Cloudflare's DDoS threat report for the first half of 2026 notes that attackers sometimes pair a high packet rate with low bandwidth, or the reverse, to hit network gear and bandwidth separately. It defines its largest attacks on three axes: above 1 Tbps, 1 billion packets per second, or 1 million HTTP requests per second.
The arithmetic: what one packet costs on the wire
On the wire, every Ethernet frame costs more than its own size. RFC 5180 gives the maximum frame rate as:
frames per second = line rate ÷ (8 × (frame size + 20 bytes))
The 20 bytes are an 8-byte preamble and a 12-byte inter-frame gap. The smallest Ethernet frame is 64 bytes. The largest untagged one is 1,518 bytes: a full 1,500-byte IP packet, the most RFC 894 allows over Ethernet, plus 18 bytes of header and checksum.
- Minimum frames: 64 + 20 = 84 bytes = 672 bits. 10,000,000,000 ÷ 672 = 14,880,952 packets per second on a 10 Gbps link.
- Full-size frames: 1,518 + 20 = 1,538 bytes = 12,304 bits. 10,000,000,000 ÷ 12,304 = 812,743 packets per second.
Same pipe, 18.3 times the packets. Reversed, it gives the conversion a DDoS spec needs: 1 Mpps of minimum frames is 1,000,000 × 672 bits = 0.672 Gbps; of full-size frames, 12.3 Gbps.
| Frame size | On the wire | Packets/s at 10 Gbps | Gbps at 1 Mpps |
|---|---|---|---|
| 64 bytes (minimum) | 84 bytes | 14,880,952 | 0.672 |
| 512 bytes (mixed flood) | 532 bytes | 2,349,624 | 4.256 |
| 1,518 bytes (full-size) | 1,538 bytes | 812,743 | 12.304 |
The rates match RFC 5180's 10 Gb/s table. A mix averaging 512 bytes behaves like the middle row.
One formula for any tier
For a tier of G Gbps / M Mpps, the two limits meet where packets average:
crossover = G ÷ M × 125 bytes on the wire
That is G × 1,000,000,000 bits ÷ (M × 1,000,000 packets × 8). Smaller packets exhaust the Mpps limit first; larger ones the Gbps limit.
Take an example tier of 20 Gbps / 2 Mpps. Its crossover is 20 ÷ 2 × 125 = 1,250 bytes, between a mixed flood and a full-size one. A 64-byte SYN flood reaches 2 Mpps at 1.34 Gbps, under 7% of the bandwidth. A full-size flood fills the 20 Gbps first, at 1.63 Mpps (20,000,000,000 ÷ 12,304). The same tier runs out of packets against small floods and out of bandwidth against large ones.
Which limit runs out first on each tier
On paper, each cell names the limit a flood reaches first, and where the other meter stands then. The three tiers are examples chosen to show the patterns, not any provider's price list. Crossovers are bytes on the wire (counting IP bytes instead flips no cell).
| Example tier (crossover) | 64-byte flood | 512-byte mix | 1,518-byte flood |
|---|---|---|---|
| 20 Gbps / 2 Mpps (1,250 B) | Mpps, at 1.3 Gbps | Mpps, at 8.5 Gbps | Gbps, at 1.6 Mpps |
| 50 Gbps / 3 Mpps (2,083 B) | Mpps, at 2.0 Gbps | Mpps, at 12.8 Gbps | Mpps, at 36.9 Gbps |
| 100 Gbps / 20 Mpps (625 B) | Mpps, at 13.4 Gbps | Mpps, at 85.1 Gbps | Gbps, at 8.1 Mpps |
Two things stand out:
- Small packets are a packet problem on every tier. A 64-byte flood fills each example's packet budget at 4% to 13% of its bandwidth. More Gbps alone does nothing for it.
- Full-size floods split the tiers. With a crossover below 1,538 bytes, as on the 20 and 100 Gbps examples, a full-size flood reaches Gbps first. At 2,083 bytes, the 50 Gbps example still runs out of packets first, at 36.9 Gbps.
Which attacks fill which meter
Amplification floods are bandwidth-heavy. The attacker sends small requests, forged with your address as the source, to open UDP services, which send large replies to you. CISA's alert TA14-017A rates the gain as a bandwidth amplification factor, reply payload over request payload: 28 to 54 for DNS, 556.9 for NTP, 56 to 70 for CLDAP, 10,000 to 51,000 for memcached. Large replies push packet sizes up, toward the right-hand columns. They remain current: Cloudflare's H1 2026 report has CLDAP floods up 580% quarter on quarter, the third most common network-layer vector in Q2.
SYN, ACK and small UDP floods are packet-heavy. A SYN normally carries no data, so these packets sit at or near the 64-byte minimum, the left-hand column. DNS can be either: Cloudflare separates a botnet's own query floods from amplified answers, and the two together were 34.3% of network-layer attacks in the first half of 2026.
Packets matter at the very top end, too. Cloudflare's Q4 2025 report classed 384 of the 902 hyper-volumetric attacks in December's "Night Before Christmas" campaign as packet-intensive, against 329 bit-intensive and 189 request-intensive.
Layer 7 is a third meter: requests per second
HTTP floods are counted in requests per second, and the network meters barely register them. Each request comes over a real, usually encrypted connection, so it looks like a visitor. A hypothetical 10,000 requests a second at 1,000 bytes each is 10,000 × 1,000 × 8 = 0.08 Gbps: invisible on a 100 Gbps meter, yet 10,000 page renders a second. Cloudflare's Q4 2025 report recorded a campaign peak of 205 million requests per second.
The protection included with NexonHost VPS and dedicated servers is network filtering at Layers 3 and 4, and only the top 10 Tbps tier adds Layer 7 filtering, so below it requests are the job of the website DDoS protection proxy: SSL support, WAF support, a web challenge for bots and GEO-IP blocking in front of your origin. Remote DDoS protection plans are sized by clean traffic and Layer 4 Gbps, from €49 a month for 3 TB and 10 Gbps. The plan pages publish no requests-per-second ceiling, so ask. Understanding Layer 7 DDoS attacks covers the attack types.
How to read a provider's spec sheet
- Ask for both numbers. A Gbps-only figure hides the limit a small-packet flood finds. Divide one by the other and multiply by 125 to see where the tier tips over.
- Ask what happens above the tier. Practice varies: some providers filter up to the tier and drop the excess, some null-route the attacked address for a time to protect their network, and some move you to a bigger tier. Get the answer in writing.
- Ask when filtering starts. Cloudflare found 90.60% of network-layer attacks in the first half of 2026 ended in under 10 minutes, so protection someone has to switch on can arrive after the attack.
- Ask about Layer 7 separately, in requests per second.
How large a tier you need is a separate question; see How much DDoS protection is enough for a dedicated server and the 2026 dedicated server DDoS checklist. If an attack is under way now, start with what to do when your server is under DDoS attack.
Choosing a NexonHost tier
Once you read gbps vs mpps as two separate limits, choosing a tier comes down to which column your threat lives in. NexonHost's tiers are the same on every VPS and dedicated server, and the store states them in Gbps only:
| Tier | Filtering | Price a month |
|---|---|---|
| 100 Gbps | Layer 4 | Included |
| 500 Gbps | Layer 4 | €149 |
| 1 Tbps | Layer 4 | €499 |
| 2 Tbps | Layer 4 | €999 |
| 5 Tbps | Layer 4 | €2,499 |
| 10 Tbps | Layer 4 and Layer 7 | €4,499 |
With no packet figure, the formula above has nothing to divide by, so apply the first rule of the spec sheet to us too and ask sales what packet rate your tier filters. For scale, a flood that fills 100 Gbps carries 148.8 million packets a second at 64 bytes, 23.5 million at a 512-byte mix and 8.1 million at full size.
- UDP services that answer the public, such as game servers: small-packet floods are the threat, so the packet answer matters more than the Gbps figure. A Linux VPS from €9 a month and a dedicated server from €129 a month include the same 100 Gbps tier.
- Bandwidth-heavy floods: amplified replies are large, so size by Gbps: 100 Gbps included, then 500 Gbps to 10 Tbps for €149 to €4,499 a month.
- Websites and APIs: the threat is requests, so put the website protection proxy, from €49 a month, in front of whichever server you run.
Prices are as of 23 October 2026 for the DDoS tiers and 12 October 2026 otherwise, in euros excluding VAT. Check the product page before you order.
Sources
- RFC 5180 — IPv6 Benchmarking Methodology: section 5.1.1 on 1,518 bytes as the largest untagged Ethernet frame; Appendix A's frame-rate formula, the 20 bytes of preamble and inter-frame gap, and the 10 Gb/s frame-rate table, retrieved 12 October 2026.
- RFC 2544 — Benchmarking Methodology for Network Interconnect Devices: Ethernet test frame sizes (64 to 1,518 bytes, the minimum and maximum the standard permits), the small frame's role in measuring per-frame overhead, and Appendix B's frame-rate table, retrieved 12 October 2026.
- RFC 894 — A Standard for the Transmission of IP Datagrams over Ethernet Networks: the maximum IP datagram on Ethernet is 1,500 octets, retrieved 12 October 2026.
- CISA alert TA14-017A — UDP-Based Amplification Attacks: bandwidth amplification factors for DNS, NTP, CLDAP and memcached (archived, last revised 18 December 2019), retrieved 12 October 2026.
- Cloudflare DDoS Threat Report H1 2026 — hyper-volumetric thresholds, packet-rate versus bandwidth attacks, CLDAP growth, DNS share, attack duration (published 11 August 2026), retrieved 12 October 2026.
- Cloudflare 2025 Q4 DDoS threat report — "Night Before Christmas" campaign attack counts by type and peak request rate (published 5 February 2026), retrieved 12 October 2026.
- NexonHost store configurator — DDoS protection tiers and prices on the Xeon and EPYC dedicated builds and the VPS plans, retrieved 23 October 2026; remote protection plan features, retrieved 12 October 2026.
- Computed: wire bits = (frame + 20) × 8; packets per second = line rate ÷ wire bits; Gbps at M Mpps = M × 1,000,000 × wire bits ÷ 1,000,000,000; crossover = Gbps ÷ Mpps × 125 bytes; 14,880,952 ÷ 812,743 = 18.3; example tiers: 2, 3 and 20 Mpps × 0.672 = 1.344, 2.016 and 13.44 Gbps (6.7%, 4.0% and 13.4% of 20, 50 and 100 Gbps); 20,000,000,000 ÷ 12,304 = 1.63 Mpps; 100,000,000,000 ÷ 672, 4,256 and 12,304 = 148.8, 23.5 and 8.1 million packets per second; 10,000 × 1,000 × 8 = 0.08 Gbps.
