> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Distributed Denial-of-Service (DDoS) Protection for Megaport Internet

> This help topic describes the options for Distributed Denial-of-Service (DDoS) protection for Megaport Internet connections in the Megaport Portal.

export const Image = ({src, alt = '', caption, width, height, shadow}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Image -';
  if (typeof src !== 'string') {
    src = String(src);
  }
  if (!src || src === 'undefined') {
    console.error(`${errorPrefix} \`src\` is required — rendering an empty string instead`);
    return <></>;
  }
  const img = <img className={['mega-image-style', shadow ? 'shadow' : ''].join(' ')} src={src} alt={alt} width={width} height={height} style={{
    display: 'block'
  }} />;
  return caption ? <figure>
      {img}
      <figcaption style={{
    textAlign: 'center',
    width
  }}>{caption}</figcaption>
    </figure> : img;
};

export const GlossaryDdos = () => <>
    A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised sources.
  </>;

export const Gloss = ({term, anchor, langDir = 'en', description, children}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Gloss -';
  const id = 'gloss-' + React.useId().replace(/:/g, '');
  const [expanded, setExpanded] = React.useState(false);
  if (typeof term !== 'string') {
    term = String(term);
  }
  if (!term || term === 'undefined') {
    console.error(`${errorPrefix} the \`term\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const content = children ?? description;
  const hasContent = content !== undefined && content !== null && content !== '' && content !== 'undefined';
  if (!hasContent) {
    if (typeof anchor !== 'string') {
      anchor = String(anchor);
    }
    if (!anchor || anchor === 'undefined') {
      console.error(`${errorPrefix} either \`anchor\`, \`description\`, or child content is required — rendering an empty string instead`);
      return <></>;
    }
    const lang = langDir === 'en' ? '/' : '/' + langDir + '/';
    const glossaryPage = lang + 'glossary/#' + anchor;
    return <a href={glossaryPage}>{term}</a>;
  }
  return <span>
      <button type="button" aria-expanded={expanded} aria-controls={id} onClick={() => setExpanded(value => !value)} className="underline decoration-dotted underline-offset-4 text-gray-700 hover:text-gray-900 dark:text-gray-300 dark:hover:text-gray-100">
        {term}
      </button>
      <span id={id} hidden={!expanded} style={{
    borderLeftColor: 'var(--color-primary)'
  }} className="mt-2 flex flex-col gap-1 rounded-lg border border-l-4 border-gray-200 bg-gray-50 px-5 py-4 text-sm dark:border-gray-700 dark:bg-white/5">
        <span className="text-xs font-bold tracking-wide text-gray-500 uppercase dark:text-gray-400">
          Glossary
        </span>
        <span className="font-semibold text-gray-900 dark:text-gray-100">
          {term}
        </span>
        <span className="text-gray-700 dark:text-gray-300">{content}</span>
      </span>
    </span>;
};

export const Link = ({href, children}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Link -';
  if (typeof href !== 'string') {
    href = String(href);
  }
  if (!href || href === 'undefined') {
    console.error(`${errorPrefix} the \`href\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (href.includes('{') || href.toUpperCase().includes('%7B')) {
    console.error(`${errorPrefix} could not resolve a variable in href "${href}" — rendering an empty string instead`);
    return <></>;
  }
  const isExternal = (/^https?:\/\//).test(href);
  return <a href={href} className="link" target={isExternal ? '_blank' : undefined} rel={isExternal ? 'noreferrer' : undefined}>
      {children ?? href}
      {isExternal && <span className="sr-only"> (opens in a new tab)</span>}
    </a>;
};

<Gloss term="Distributed denial-of-service (DDoS)"><GlossaryDdos /></Gloss>  attacks attempt to overwhelm a target with large volumes of traffic, making it unavailable to legitimate users.

Megaport offers DDoS protection as an optional service for Megaport Internet connections. DDoS protection monitors traffic patterns and, depending on the protection option selected, either alerts you to potential attacks or automatically mitigates them.

DDoS protection is enabled at the account level and applies to all eligible Megaport Internet connections under your account. DDoS protection is available only for Megaport Internet connections at eligible locations.

When DDoS protection is enabled for your account, it is automatically applied to new Megaport Internet connections at eligible locations. If DDoS protection becomes available at an additional location, it is also automatically applied to existing eligible connections at that location.

## Features and benefits

DDoS protection for Megaport Internet connections provides these benefits:

* **Quick to enable** -- Enable DDoS protection from the Portal. Protection applies in under 60 seconds.

* **Helps keep your network up under attack** -- In Protecting mode, Megaport blocks malicious traffic and delivers legitimate traffic to your connection.

* **Stays on the Megaport network** -- Megaport scrubs attack traffic on its own network, so your traffic does not detour across the public internet to a separate vendor.

* **Flat, predictable cost** -- You pay a monthly add-on for each connection, set by the rate limit of the connection. Attack size and attack count do not change your bill.

* **You choose the mode** -- Monitoring mode detects attacks without blocking them, allowing Megaport to establish a baseline of your normal traffic patterns before you enable Protecting mode. Protecting mode detects and blocks attacks. You can switch between modes at any time.

* **Cancel any time** -- Charges end on the cancellation date. The add-on does not add to your early termination fee (ETF).

For more information about DDoS billing and invoicing, see [Billing Overview](/finance/overview).

<Callout icon="triangle-exclamation" color="red">
  Traffic rerouting during a mitigation event might increase latency, particularly if the nearest scrubbing center is not co-located in the Megaport Internet metro of the A-End service.
</Callout>

## Supported customer connectivity types

DDoS protection is available for Megaport Internet connections that use these customer connectivity types:

* Dedicated Internet Access (DIA)
* Border Gateway Protocol (BGP)

  <Callout icon="triangle-exclamation" color="red">
    If you use BGP with Megaport Internet and have multiple upstream providers, Megaport DDoS protection applies only to traffic routed through Megaport. Traffic received through other upstream providers is not protected or mitigated by Megaport DDoS protection.
  </Callout>

## Enabling DDoS protection

DDoS protection is enabled at your account level. When you enable DDoS, all eligible Megaport Internet connections under your account will be protected.

<Note>
  To enable, change, or cancel DDoS protection, you must be a Company Admin or Technical Admin.
</Note>

**To enable DDoS protection for your account**

1. Log in to the <Link href="https://portal.megaport.com">Megaport Portal</Link> and choose **Services**.

2. Click **Add Service**.

3. Click **DDoS protection**.

   <Note>
     If DDoS is already enabled for your account, the **DDoS protection** option will be grayed out.
   </Note>

4. Select the Operational mode (Monitoring mode or Protecting mode) for your Megaport Internet connection. For more information, see [DDoS operational modes](#ddos-operational-modes).

   The Portal displays eligible Megaport Internet connections, indicating which have DDoS protection enabled and showing the associated add-on pricing. Connections that are not covered by DDoS protection are also listed for reference.

5. Click **Add DDoS protection**.

6. Click **Review Order** to proceed.

7. Click **Order Now** to complete the process.

The DDoS protection service will appear as a service in the <Link href="https://portal.megaport.com">Megaport Portal</Link> under **Services**.

<Image src="/images/megaport-internet/ddos-service-line.png" alt="DDoS service line in the portal" shadow={true} width={700} />

<Note>
  Your invoice does not show DDoS protection service details. It lists only the DDoS protection add-on charges for each connection.
</Note>

## DDoS operational modes

DDoS operational modes allow you to customize the level of protection for your Megaport Internet connection based on the expected traffic patterns and potential threat landscape.

The available operational modes are:

* **Monitoring mode** -- The DDoS protection system monitors traffic and generates alerts for potential attacks but does not actively mitigate them. This mode is useful for understanding normal traffic patterns and tuning protection settings.

* **Protecting mode** -- The DDoS protection system actively mitigates detected attacks, rerouting and scrubbing malicious traffic to protect the Megaport Internet connection. This mode provides active defense against DDoS attacks.

You can switch between the different operational modes based on your requirements and the observed traffic patterns for your Megaport Internet connection.

<Note>
  * The operational mode is set for the whole account. You cannot set it individually for each Megaport Internet connection.
  * Changing the operational mode does not affect existing DDoS protection add-on charges.
</Note>

**To switch the DDoS operational mode for your Megaport Internet connection**

1. Log in to the <Link href="https://portal.megaport.com">Megaport Portal</Link> and choose **Services**.
2. Select the DDoS protection service from the list of services.
3. Select the **Configuration** tab.
4. Select the DDoS operational mode for your Megaport Internet connection.
5. Click **Save**.

<Note>
  If the service is locked, has a pending partner approval request, or you do not have permission to edit it, the Configuration tab is read-only and shows a message that explains why.
</Note>

## Canceling DDoS protection

If you cancel DDoS protection for your account, all eligible Megaport Internet connections will no longer have DDoS protection applied. Any existing DDoS protection add-on charges will be removed, and the final charges will appear on your next invoice.

To cancel DDoS protection for your account, delete the DDoS protection service from the list of services.

**To cancel DDoS protection for your account**

1. Log in to the <Link href="https://portal.megaport.com">Megaport Portal</Link> and choose **Services**.
2. Find the DDoS protection service in the list of services then click **Delete**.

<Image src="/images/megaport-internet/ddos-delete.png" alt="Delete DDoS protection" shadow={true} width={700} />

## When a protected connection terminates

When a protected Megaport Internet connection terminates, DDoS protection coverage for that connection ends. This applies whether the connection terminates on its own or as part of terminating the Port, MCR, MVE, or NAT Gateway to which it is attached.

The recurring DDoS protection add-on charge for that connection also ends.

If you terminate a protected connection before the end of its contract term, the early termination fee (ETF) is calculated based only on the connection price, excluding DDoS protection charges. Charges for DDoS protection stop on the termination date.

The DDoS protection product itself and every other protected connection stay unaffected. The product remains live and continues to protect the rest of the connections.

For more information, see [Terminating a Megaport Internet Connection](/megaport-internet/terminating-connection).

## Moving a Megaport Internet B-End

When you move the B-End of a Megaport Internet connection covered by DDoS protection, coverage follows the connection to its new B-End if the new B-End is on a DDoS-capable transit port in the same metro area.

For more information, see [Moving VXCs](/connections/move-vxc).

## DDoS billing

DDoS protection is billed as an add-on service for each eligible Megaport Internet connection. The monthly rate is based on the rate limit of the connection. You can view the DDoS protection Monthly Rate in the Megaport Internet connection summary during the connection creation process.

<Note>
  The DDoS add-on charge will inherit the discount of the underlying VXC the add-on charge is associated to.
</Note>

On your monthly invoice, the DDoS protection add-on charge will be listed separately for each eligible Megaport Internet connection.

## Helpful references

* [Creating a Megaport Internet Connection for an MCR](/megaport-internet/mcr)
* [Creating a Megaport Internet Connection for an MVE](/megaport-internet/mve)
* [Creating a Megaport Internet Connection for a NAT Gateway](/megaport-internet/nat-gateway)
* [Creating a Megaport Internet Connection for a Port](/megaport-internet/port)
* [Megaport Internet Pricing and Contract Terms](/finance/megaport-internet-pricing)
* [Megaport Internet Routing Guide](/megaport-internet/routing)
* [Monitoring Ports, VXCs, Megaport Internet, and IXs](/monitoring/port-vxc-monitoring)
* [Terminating a Megaport Internet Connection](/megaport-internet/terminating-connection)
* [Troubleshooting Megaport Internet Connectivity](/troubleshooting/mic/megaport-internet)
* [Understanding the Services Page](/portal-admin/services-page)
* [VXC, Megaport Internet, and IX Billing ](/finance/billing-details)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.