WAF + challenges vs Rate limiting — Dstat comparison
A full WAF/challenge stack and plain rate limiting are complementary Layer-7 defenses with different strengths.
WAF + challenges
- Inspects and challenges suspicious requests.
- Adapts to attack patterns in real time.
- Higher protection, more moving parts.
Rate limiting
- Caps requests per client over a window.
- Simple, predictable, low overhead.
- Blunt against distributed low-and-slow floods.
How each defense changes the Dstat curve
Rate limiting produces a distinctive flat top. Incoming requests can spike, but the passed line is capped at the configured threshold per client, so bypass stays flat as long as the flood comes from a manageable number of sources. Traffic that exceeds the limit is counted as blocked.
A WAF and challenge stack produces a different pattern: the bypass line drops sharply when a challenge engages, and the blocked share grows with the attack rather than staying at a fixed ceiling. Because rules adapt to request characteristics rather than just rate, the effect is visible even when the flood is spread across many IPs.
Where each one falls short
Rate limiting keys on a client identifier, typically the IP address. A distributed flood that sends a few requests per second from thousands of addresses stays under every per-client threshold, and the Dstat shows bypass rising in step with incoming traffic. Tightening the limit to compensate starts to throttle legitimate users behind shared NAT.
A WAF and challenge stack has more configuration surface and more ways to misfire: overly strict rules block real users, and challenges add latency to the first request. It is also not free of bypass — headless browsers can solve JS challenges — which is why the Dstat bypass line should be checked after every rule change rather than assumed to be zero.
Takeaway
Pair rate limiting as a cheap baseline with a WAF/challenge layer for adaptive defense against larger Layer-7 attacks.
Frequently asked questions
Is rate limiting enough on its own against a Layer 7 DDoS?
Against floods from a small number of sources, often yes. Against a distributed flood it is not, because each source stays under the per-client threshold. The Cloudflare Rate Limit Dstat on this site shows this behaviour live.
Should rate limiting be removed once a WAF is in place?
No. Rate limiting is cheap, predictable and stops simple bursts before they reach the WAF's more expensive evaluation. The two are layered: rate limiting as the baseline, WAF rules and challenges for what the baseline cannot classify.
What does a rate-limited target look like on a Dstat?
A flat passed line at the threshold while the incoming line spikes above it, with the difference counted as blocked. If the passed line rises with incoming traffic instead, the limit is not engaging for that traffic pattern.