Skip to content
ENExplore Calculators

DDoS Mitigation Capacity Calculator

Work out ddos mitigation capacity instantly with clear inputs, formula shown and shareable results.

About DDoS Mitigation Capacity Calculator

Mitigation capacity must exceed attack plus legitimate traffic, since both traverse the scrubbing centre. Equally important is leakage tolerance: scrubbing is never perfect, and the origin link has to absorb whatever fraction gets through alongside real traffic. With a 10 Gbps origin under a 180 Gbps attack, even three percent leakage saturates the link.

Formula

Mitigation headroom

headroom = scrubbing capacity - (attack + legitimate); tolerable leakage = (origin capacity - legitimate) / total attack traffic

Worked example

With the default values below, DDoS Mitigation Capacity Calculator returns Spare scrubbing capacity of 316.00. Change any input above and every figure here is recalculated in your browser.

Inputs used

Scrubbing capacityminimum 0.1 Gbps
500 Gbps
Expected attack volumeminimum 0.1 Gbps
180 Gbps
Legitimate trafficminimum 0.01 Gbps
4 Gbps
Origin link capacityminimum 0.1 Gbps
10 Gbps

Results

Spare scrubbing capacity
316.00 Gbps
Scrubbing capacity used
36.8%
Leakage the origin link can absorb
3.261%
Assessment
Comfortable headroom

Step by step

  1. 1Values used
  2. 2Mitigation headroom
  3. 3Spare scrubbing capacity= 316.00 Gbps
  4. 4Scrubbing capacity used= 36.8
  5. 5Leakage the origin link can absorb= 3.261
  6. 6Assessment= Comfortable headroom

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is leakage tolerance so tight?

Because the origin link is orders of magnitude smaller than the attack. A single-digit percentage of a large attack still exceeds a typical enterprise circuit.

Does always-on mitigation beat on-demand?

For latency-sensitive services yes, because BGP-based on-demand diversion takes minutes to take effect, during which the origin is fully exposed.

Related Calculators

DDoS Mitigation Capacity Calculator | Calcrivo