Network Protection moves traffic for your IP prefixes through SentiGate with BGP. Floods get scrubbed at layers 3 to 5, and clean traffic comes back to your routers over GRE or a direct link. This protects every service on those addresses, from game servers to VPN gateways.
Scroll down to follow a typical attack on an example network, AS64500 with the prefix 203.0.113.0/24, from start to finish.
In on-demand mode your prefix is announced by your own upstreams, and SentiGate stays on standby. In always-on mode, traffic already flows through our gates every day, so the flood in step 2 never reaches your uplink and nothing needs to reroute.
An attacker sends 48 Gbps of UDP at a game server on 203.0.113.14. Your 10 Gbps uplink fills up in seconds, and every service on the prefix suffers, including the ones nobody was targeting.
The switch starts automatically based on your flow data, or after one message to our NOC. Your routers stop announcing 203.0.113.0/24 to your upstreams and we announce it from all 11 gates, so the internet starts sending that traffic to us.
Anycast splits the attack across sites close to its sources. Spoofed packets, amplification traffic, malformed packets and SYN floods get dropped at layers 3 to 5, while real traffic keeps going.
What’s left reaches your border router through a GRE tunnel or a direct cross-connect. Replies leave through your own ISP as usual, so your outbound path doesn’t change.
When the attack is over and you’re happy with how things look, the announcement is withdrawn and traffic goes back to your upstreams. You get a report of everything that happened.
Both modes use the same gates and the same filters. The difference is whether your traffic passes through us every day or only when it needs to.
Your prefixes are announced from SentiGate all the time. Every packet passes through the gates, so an attack meets filters that are already running and there’s nothing to reroute.
Best for networks that get hit often: game hosting, VPN providers, hosting companies and other frequent targets.
Traffic uses your own upstreams on a normal day. When an attack starts, the prefix moves to SentiGate automatically based on your flow data, or when you ask, and goes back once it’s over.
Best for networks that rarely see attacks and want their everyday traffic to take the most direct path.
Pick whichever fits your network. Some customers use both, with a cross-connect where we share a building and GRE everywhere else.
This works over the internet with almost any router. We set up tunnels from several gates to your border, so clean traffic has more than one way home. We’ll help you get MTU and MSS right, since tunnels add a few bytes to every packet.
If your equipment sits in a facility where we have a gate, we can run a physical link between our routers and yours. There’s no tunnel overhead, and the path for clean traffic is very short.
ICMP floods, IP fragmentation attacks, spoofed and bogon sources, GRE and other protocol floods, carpet bombing across a whole prefix.
SYN, ACK, RST and FIN floods, UDP floods, reflection and amplification from DNS, NTP, memcached, SSDP, CLDAP and similar protocols, TCP state exhaustion.
TLS handshake floods, connection and session exhaustion, slow connection attacks that try to keep every socket on your servers busy.
The full list is in the attack coverage section.
None of this is unusual. If you run your own prefixes, you probably have most of it already, and we’ll help with the rest.
If you have a more unusual question, send it to us. Our engineers like those.
A /24 for IPv4. Most networks on the internet filter out anything smaller, so a /25 announced through us wouldn’t propagate and traffic would keep taking its normal path.
Usually by very little. Traffic enters the nearest of our 11 gates and then travels to you over a tunnel or cross-connect. With on-demand mode, your everyday traffic doesn’t pass through us at all.
Network Protection works on whole prefixes. If you need to protect a website or an API on a single address, Web App & API Protection is the better fit.
Yes. Policies can be set per prefix and per host, so a game server, a mail server and a VPN gateway in the same /24 each get filters that fit their traffic.
Every attack gets a report: when it started and ended, peak bandwidth and packet rate, attack vectors, which gates absorbed it and how much clean traffic reached you.
Tell us about your network and how often it gets hit, and we’ll suggest a mode and send a quote.