Flooding attacks are successful because more service requests can be sent to a service host than it can process within a short period of time. Hence a limiting functionality is necessary to simply refuse or ignore any more requests than services can handle within a given period. Similarly, the service hosts should be protected against being forced to shut down by reserving a minimum of system resources necessary to keep them up and running. In addition, one should shield services of a host by installing proxying agents for each of the services. Such agents may be designed to inspect and authenticate requests for service, filter out those that are malformed or fail authentication, and then pass only the qualified requests to the appropriate service host.
Several tools exist to permit greater security, control and auditing of services.
This is achieved by replicating a service across several independent systems so that an attack against one system does not wipe out all availability of that service. Such monitoring not only serves to allow detection of anomalies, but also facilitates auditing of network and host configurations. Given a sufficiently robust environment, one may also choose to implement a dynamic, retreating facility, by which systems will automatically react to bursts of service requests, or to other suspicious activity, by temporarily disabling affected areas until the burst or other activity subsides. This strategy, however, only serves to protect the target systems themselves. Nevertheless, it is generally a good practice to implement self-defensive mechanisms on systems, especially if such systems are expected to operate in an unattended manner.