> ## Documentation Index
> Fetch the complete documentation index at: https://docs.packets-decreaser.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Known Technical Impact

## TCP authentication under permanent protection

Permanent protection forces TCP authentication on every new connection. This means the very first packet in a new TCP session is reset, and the client must initiate a second handshake to complete the connection.

<Info>
  This behaviour is by design and is not a sign of misconfiguration. Standard TCP clients retry automatically and the impact is typically sub-second.
</Info>

<Warning>
  Cloudflare and other CDN providers typically do not retry after receiving a TCP reset. \
  \
  If you route traffic through a CDN, mitigation will break that path. This is a known incompatibility.
</Warning>

## Rate limiting during active attacks

The following traffic types are subject to rate limiting, but **only while an attack of the same type is actively ongoing**. Rate limits are not applied to clean traffic outside of attack windows.

| Traffic type | Condition for rate limiting |
| - | - |
| TCP | Only during an active TCP attack |
| UDP | Only during an active UDP attack |
| ICMP | Rate limited or blocked under attack |
| DNS | Limited to common resolvers (see below) |

<Note>
  By default, all UDP ports not covered by a specific application or game filter are limited to a specific destination limit. If your UDP service uses a non-standard port, please contact Support to request a dedicated filter or further assistance.
</Note>

## DNS resolver restrictions

During a DNS attack, DNS traffic is restricted to requests sourced from the following well-known public resolvers:

* `1.1.1.1` and `1.0.0.1` — Cloudflare DNS
* `8.8.8.8` and `8.8.4.4` — Google Public DNS
* `9.9.9.9` — Quad9

DNS queries from resolvers outside this list may be dropped while mitigation is active. \
If your application relies on a private or non-standard resolver, be aware that DNS resolution may fail for users behind those resolvers during an attack.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.