The results in Table 3 indicate that when there is no attack RED has no obvious influence on the normal TCP flows (ρna and rna are almost the same for DropTail and RED). However, when LDDoS attacks are present, RED significantly improves the throughput of normal TCP. Note that in this case, RED drops 25% packets, much more than the 7.6% from DropTail. In other words, when the aggregate rate of the LDDoS flows is very close to the bottleneck bandwidth of network, deploying RED is able to drop more attack packets while increasing the throughput of the normal TCP flows. Admittedly RED might also drop more legitimate packets than DropTail here, however it achieves a higher normal-TCP-flow throughput ρa than DropTail. The throughput ρa of normal TCP flows is considered to be more important than its drop ratio ra when a network is under an LDDoS attack.
packets
RED drops
25%
%
packets
DropTail
7.6%
%