The challenge in preventing DoS and DDoS attacks lies in the nature of the traffic and the nature of the "attack" because most often the traffic is legitimate as defined by a protocol. Therefore, there is not a straightforward approach or method to filter or block the offending traffic.
防範 DoS 與 DDoS 攻擊的挑戰在於流量本身的性質，以及「攻擊」的本質，因為這些流量大多數情況下依協定定義而言是合法的。因此，並沒有直接的方法可以過濾或封鎖惡意流量。
There are two types of attacks, volumetric and application-level. Volumetric attacks use an increased attack footprint that seeks to overwhelm the target. This traffic can be application specific, but it is most often simply random traffic sent at a high intensity to overutilize the target's available resources. Volumetric attacks generally use botnets to amplify the attack footprint. Additional examples of volumetric attacks are Domain Name System (DNS) amplification attacks and TCP SYN floods. Application-level attacks exploit specific applications or services on the targeted system. They typically bombard a protocol and port a specific service uses to render the service useless. Most often, these attacks target common services and ports, such as HTTP (TCP port 80) or DNS (TCP/UDP port 53).
攻擊有兩種類型：流量型（volumetric）與應用層級（application-level）。流量型攻擊會使用擴大的攻擊足跡，企圖淹沒目標。這類流量可能是特定於應用程式的，但最常見的情況是以高強度傳送隨機流量，藉此耗盡目標可用資源。流量型攻擊通常使用殭屍網路（botnet）來放大攻擊足跡。流量型攻擊的其他範例還包括網域名稱系統（DNS）放大攻擊與 TCP SYN 洪水攻擊。應用層級攻擊則利用目標系統上特定的應用程式或服務。這類攻擊通常會轟炸特定服務所使用的協定與連接埠，使該服務失去作用。這些攻擊最常鎖定常見服務與連接埠，例如 HTTP（TCP 連接埠 80）或 DNS（TCP/UDP 連接埠 53）。
Some of the various solutions that can protect against denial of service (DoS) and distributed denial of service (DDoS) attacks are as follows:
以下是一些可用於防範阻斷服務（DoS）與分散式阻斷服務（DDoS）攻擊的解決方案：
- Stateful devices, such as firewalls and IPS systems: Stateful devices do not provide complete coverage and mitigation for DDoS attacks because of their ability to monitor connection states and maintain a state table. Maintaining such information is central processing unit (CPU) and memory intensive. When bombarded with an influx of traffic, the stateful device spends most, if not all, of its resources tracking states and further connection-oriented details. This effort often causes the stateful device to be the "choke point" or succumb to the attack.具狀態裝置，例如防火牆與 IPS 系統：具狀態裝置無法對 DDoS 攻擊提供完整的涵蓋與緩解，因為它們需要監控連線狀態並維護狀態表。維護此類資訊會大量消耗中央處理器（CPU）與記憶體資源。當受到大量流量轟炸時，具狀態裝置會將大部分（甚至全部）資源用於追蹤狀態與其他連線導向的細節。這種情況通常會使具狀態裝置成為「瓶頸」，甚至被攻擊擊垮。
- Route filtering techniques: Remotely triggered black hole (RTBH) filtering can drop undesirable traffic before it enters a protected network. Network black holes are places where traffic is forwarded and dropped. When an attack has been detected, black holing can be used to drop all attack traffic at the network edge, based on destination or source IP address.路由過濾技術：遠端觸發黑洞（RTBH）過濾可在惡意流量進入受保護網路之前將其丟棄。網路黑洞是流量被轉送並丟棄的地方。偵測到攻擊後，可根據目的地或來源 IP 位址，使用黑洞技術在網路邊界丟棄所有攻擊流量。
- Unicast Reverse Path Forwarding: Network administrators can use Unicast Reverse Path Forwarding (uRPF) to help limit malicious traffic flows occurring on a network, as is often the case with DDoS attacks. This security feature works by enabling a router to verify the "reachability" of the source address in packets being forwarded. This capability can limit the appearance of spoofed addresses on a network. If the source IP address is not valid, the packet is discarded.單播反向路徑轉送：網路管理員可使用單播反向路徑轉送（uRPF）來協助限制網路上發生的惡意流量，這在 DDoS 攻擊中很常見。此安全功能可讓路由器驗證所轉送封包中來源位址的「可達性」。此能力可限制偽造位址出現在網路上。若來源 IP 位址無效，該封包即會被捨棄。
- Geographic dispersion (global resources anycast): A newer solution for mitigating DDoS attacks dilutes attack effects by distributing the footprint of DDoS attacks so that the targets are not individually saturated by the volume of attack traffic. This solution uses a routing concept known as anycast. Anycast is a routing methodology that allows traffic from a source to be routed to various nodes (representing the same destination address) via the nearest hop or node in a group of potential transit points. This solution effectively provides "geographic dispersion."地理分散（全球任播資源）：一種較新的 DDoS 攻擊緩解方案，是透過分散 DDoS 攻擊的足跡來稀釋攻擊效果，使目標不會被單一集中的攻擊流量淹沒。此方案使用一種稱為任播（anycast）的路由概念。任播是一種路由方法，可讓來自來源的流量透過一組潛在傳輸點中最近的一跳或節點，路由到多個代表同一目的地位址的節點。此方案能有效提供「地理分散」。
- Tightening connection limits and timeouts: Antispoofing measures such as limiting connections and enforcing timeouts in a network environment seek to ensure that DDoS attacks are not launched or spread from inside the network, intentionally or unintentionally. Administrators are advised to leverage these solutions to enable antispoofing and thwart random DDoS attacks on the inside "zones" or internal network. Such limitations that can be configured on the firewalls are half-opened connection limits, global TCP SYN-flood limits, and so on.收緊連線限制與逾時：限制連線數與強制執行逾時等防偽造措施，旨在確保 DDoS 攻擊不會刻意或無意間從網路內部發起或擴散。建議管理員善用這些方案來啟用防偽造機制，並遏止內部「區域」或內部網路中的隨機 DDoS 攻擊。可在防火牆上設定的此類限制包括半開連線數限制、全域 TCP SYN 洪水限制等。
- Reputation-based blocking: Reputation-based technology provides URL analysis and establishes a reputation for each URL. Reputation technology has two aspects. The intelligence aspect couples worldwide threat telemetry, intelligence engineers, and analytics/modeling. The decision aspect focuses on the trustworthiness of a URL. Reputation-based blocking limits the impact of untrustworthy URLs.信譽式封鎖：信譽技術提供 URL 分析，並為每個 URL 建立信譽評等。信譽技術有兩個面向：情報面向結合了全球威脅遙測、情報工程師及分析／建模；決策面向則專注於 URL 的可信度。信譽式封鎖可限制不可信 URL 造成的影響。
- Access control lists: ACLs provide a flexible option to a variety of security threats and exploits, including DDoS. ACLs provide day zero or reactive mitigation for DDoS attacks, as well as a first-level mitigation for application-level attacks. An ACL is an ordered set of rules that filter traffic. Each rule specifies a set of conditions that a packet must satisfy to match the rule. Firewalls, routers, and even switches support ACLs.存取控制清單：ACL 為包括 DDoS 在內的各種安全威脅與漏洞利用提供彈性的因應選項。ACL 可為 DDoS 攻擊提供零時差或被動式緩解，也可為應用層級攻擊提供第一層緩解。ACL 是一組經排序的規則，用於過濾流量。每條規則都指定封包必須符合的一組條件，才能比對該規則。防火牆、路由器甚至交換器都支援 ACL。
- DDoS run books: The premise behind a DDoS run book is simply to provide a "playbook" for an organization in the event that a DDoS attack arises. In essence, the run book provides crisis management (better known as an incident response plan) in the event of a DDoS attack. The run book provides details about who owns which aspects of the network environment, which rules or regulations must still be adhered to, and when to activate certain processes, solutions, and mitigation plans.DDoS 應變手冊：DDoS 應變手冊（run book）的目的很簡單，就是在組織發生 DDoS 攻擊時提供一份「作戰手冊」。實質上，此手冊在發生 DDoS 攻擊時提供危機管理（也就是俗稱的事件應變計畫）。此手冊詳細說明網路環境各部分由誰負責、必須遵循哪些規則或法規，以及何時啟動特定流程、解決方案與緩解計畫。
- Manual responses to DDoS attacks: Manual responses to DDoS attacks focus on measures and solutions that are based on details administrators discover about the attack. For example, when an attack such as an HTTP GET/POST flood occurs, given the information known, an organization can create an ACL to filtering known bad actors or bad IP addresses and domains. When an attack arises, administrators can configure or tune firewalls or load balancers to limit connection attempts.對 DDoS 攻擊的人工應變：對 DDoS 攻擊的人工應變著重於根據管理員在攻擊過程中發現的細節所採取的措施與方案。舉例來說，當發生 HTTP GET/POST 洪水等攻擊時，根據已知資訊，組織可以建立 ACL 來過濾已知的惡意行為者或惡意 IP 位址與網域。當攻擊發生時，管理員可以設定或調整防火牆或負載平衡器，以限制連線嘗試次數。