DDoS Mitigation Calculator
Add up detection, diversion and ramp time to find your true time to mitigate, and the traffic lost before it engages.
Inputs
Flow-based detection typically needs 15–60 s of samples.
Total Time to Mitigate
120seconds
Attack Time Mitigated
90.0%
Unprotected Seconds
120seconds
Legitimate Requests Lost
1,440,000
Revenue at Risk
$9,000.00
Step by step
Values used
Detection time = 30 seconds; Diversion time (BGP announce + propagation) = 60 seconds; Mitigation ramp / signature build time = 30 seconds; Attack duration = 20 minutes; Legitimate requests per second = 12,000 req/s; Revenue per minute of availability = 4,500
DDoS Mitigation
time to mitigate = detection + diversion + ramp; unprotected seconds = min(attack duration, time to mitigate).
Total Time to Mitigate
= 120 seconds
Attack Time Mitigated
= 90.0
Unprotected Seconds
= 120 seconds
Legitimate Requests Lost
= 1,440,000
Revenue at Risk
= 9,000.00
How it works
Time to mitigate is the sum of three independent delays, and traffic is unprotected for every second of it. Because most attacks are short, that fixed overhead — not the mitigation quality — usually determines how much damage an event does. A two-minute time to mitigate against a three-minute attack means you were down for two-thirds of it, no matter how good the scrubbing was once it engaged.
Formula
DDoS Mitigation
time to mitigate = detection + diversion + ramp; unprotected seconds = min(attack duration, time to mitigate).
- detection
- Seconds to recognise the attack from telemetry
- diversion
- Seconds for BGP or DNS redirection to take effect
- ramp
- Seconds for countermeasures to reach full effect
Frequently Asked Questions
How is DDoS Mitigation calculated?
time to mitigate = detection + diversion + ramp; unprotected seconds = min(attack duration, time to mitigate). Time to mitigate is the sum of three independent delays, and traffic is unprotected for every second of it. Because most attacks are short, that fixed overhead — not the mitigation quality — usually determines how much damage an event does.
Why does DDoS Mitigation matter?
A two-minute time to mitigate against a three-minute attack means you were down for two-thirds of it, no matter how good the scrubbing was once it engaged.
What values do I need to enter?
This calculator takes 6 inputs: Detection time, Diversion time (BGP announce + propagation), Mitigation ramp / signature build time, Attack duration, Legitimate requests per second, Revenue per minute of availability. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I cut time to mitigate?
Always-on mitigation removes detection and diversion entirely, at the cost of steady-state latency and inspection expense. If you stay on-demand, pre-agreed BGP communities, pre-built signatures and automated triggering typically take a 5-minute manual process down to under 60 seconds.