How do paid services from DDOS attacks work?

Question

DDoS Protection

If a site is attacked by a large number of requests from different addresses, for example, through infected computers, then standard protection methods, for example, limiting the number of requests from one address, will not help. Here it is recommended to use paid services that filter traffic.
Could you please explain how such services are arranged? How do they distinguish a real request from a malicious one?

Answer 1

1. https://www.cloudflare.com/learning/ddos/ddos-miti...
2. https://beget.com/ru/articles/syncookied

Linux network kernel diagram

Answer 2

For example, they serve many clients, and if some IP address was involved in attacks on the servers of other clients, then with a high degree of probability they are attacking your site, and not just peacefully entered.
The same Cloudflare, when you first open the site, sometimes shows a captcha or, using JS, checks the browser in the background, and then marks with Cookie that this browser from this IP can be trusted for some time, because if the user has made legitimate requests from this IP lately - then his request can be skipped without extra checking.

Answer 3

By generating requests through spoofing, the server will stupidly choke