Understand the bottleneck
A volumetric attack can consume bandwidth or overwhelm a network interface before the server firewall sees a manageable flow. Host processing may drop packets, but the upstream capacity remains consumed.
Where upstream controls help
A transit provider, CDN or scrubbing partner can filter harmful traffic before it reaches the protected network. This is complementary to server-level observability and application-level controls.
Build clear boundaries
Separate symptoms visible from the host from infrastructure signals your provider can validate. Agree on escalation and recovery procedures before the next incident.
Interpret the evidence
Connection counts alone do not establish volumetric pressure or malicious intent. Combine the available metrics with provider-level observations and application health.