<![CDATA[This study evaluates a layered MikroTik RouterOS v6 firewall configuration that combines the RAW and Filter tables to mitigate traffic patterns indicative of Distributed Denial of Service (DDoS) activity on a production edge router. Five sequential scenarios (S0-S4) were observed: normal baseline, unprotected high-load traffic, Filter only, RAW only, and RAW-Filter. Performance was described using CPU utilization, TCP SYN, UDP, and ICMP packet counters, and average latency. Relative to the unprotected scenario (S1), RAW-Filter (S4) reduced peak CPU utilization from 55% to 25% (54%), total SYN packets from 2,952 to 2,068 (30%), and total UDP packets from 484,054 to 55,746 (88%); total ICMP packets increased from 915 to 1,032 (12%), while average latency remained 24 ms. RAW only (S3), however, produced the lowest observed CPU load (7% average; 11% peak), indicating a trade-off between early dropping and the additional stateful policy enforcement provided by the layered configuration. Because the scenarios were executed sequentially on one production network and the manuscript does not report repeated randomized trials or inferential statistics, the findings should be interpreted as descriptive operational evidence rather than proof of statistically significant causal superiority. The study provides practical evidence for baseline-driven firewall tuning while identifying the need for controlled replication, dynamic thresholds, and broader service-availability metrics.]]>
Copyrights © 2026
