Back to Legacy KVM Documentation

    Automated DDoS Mitigation (RamNull)

    Understanding our automated nullroute protection system

    RamNull is our customized DDoS mitigation system that automatically protects our network infrastructure from attacks.

    How RamNull Works

    RamNull automatically nullroutes targeted IPs across our network and emails respective clients when under attack. Nullroutes are lifted every few minutes and re-applied if the attack is ongoing.

    Automatic Detection

    Detects attacks in real-time without manual intervention

    Fast Response

    Applies nullroutes within seconds of attack detection

    Email Notifications

    Notifies you when your IP is under attack

    Auto-Recovery

    Automatically checks if attacks have stopped and removes nullroutes

    Network Protection

    Minimizes impact on neighboring services

    RamNull vs DDoS Protection

    Important Distinction

    RamNull is not the same as DDoS protection. A nullroute takes your IP offline temporarily to protect the network. If you need active DDoS filtering that keeps your service online, see our DDoS Protection guide.

    RamNull (Automatic)

    • Included with all services
    • No additional cost
    • Automatic activation
    • Protects network infrastructure
    • Service goes offline during attack

    DDoS Protection (Optional)

    • Service stays online during attacks
    • Active traffic filtering
    • Up to 100Gbps protection
    • Requires ordering filtered IP
    • Additional monthly cost

    What Happens During an Attack

    1

    Attack Detected

    RamNull detects abnormal traffic to your IP
    2

    Nullroute Applied

    Your IP is nullrouted to stop the attack traffic
    3

    Email Sent

    You receive a notification email
    4

    Periodic Checks

    RamNull checks every few minutes if the attack has stopped
    5

    Service Restored

    When the attack ends, the nullroute is automatically removed

    Why Nullrouting is Necessary

    When a DDoS attack targets one IP on a shared network infrastructure, the massive traffic can affect all neighboring services. By quickly nullrouting the targeted IP, RamNull:

    • Prevents network congestion from affecting other customers
    • Protects shared infrastructure from being overwhelmed
    • Minimizes downtime for the entire network
    • Allows automatic recovery when attacks stop

    Best Practices

    For Mission-Critical Services

    • • Order a DDoS-filtered IP for active protection
    • • Implement application-level DDoS mitigation (e.g., CloudFlare)
    • • Have backup IPs or services ready
    • • Monitor for unusual traffic patterns

    Reducing Attack Risk

    • • Don't advertise your server IP publicly
    • • Use a reverse proxy or CDN
    • • Implement rate limiting in your applications
    • • Keep software updated to prevent exploitation
    • • Use strong authentication to prevent brute-force attacks

    Automatic and Included

    RamNull is automatically active on all services at no additional cost. It's designed to protect the network as a whole while minimizing downtime for individual services.

    Frequently Asked Questions

    How long will my IP be nullrouted?

    Nullroutes are checked and potentially removed every few minutes. The duration depends entirely on how long the attack continues. Once the attack stops, your service will be automatically restored within minutes.

    Can I request manual removal of a nullroute?

    Generally no, because if the attack is still ongoing, manually removing the nullroute would just result in it being reapplied immediately. The best solution is to wait for the attack to end or order DDoS-filtered IPs for protection.

    Will I always receive email notifications?

    Yes, RamNull sends email notifications when your IP is nullrouted. Make sure your contact email is up to date in the Client Area.

    Need DDoS Protection?

    If your service is frequently targeted or requires continuous uptime during attacks, consider ordering DDoS-filtered IPs for active protection instead of nullrouting.