Baselines built from your traffic
We learn what normal looks like for each of your services: packet rates, protocols, sizes and where traffic comes from. An attack stands out against your own baseline.
Seven layers, and attackers use most of them.
The OSI model splits networking into seven layers, and there’s an attack for nearly every one. Pick a layer to see which attacks happen there and which part of SentiGate deals with them.
Layer 4 · Transport
The busiest layer for attackers.
SYN floods fill connection tables, while UDP floods and amplification attacks fill your bandwidth. Anycast spreads them across our gates, and stateless filters drop them close to where they came from.
SYN floodACK, RST and FIN floodsUDP floodDNS amplificationNTP reflectionmemcachedSSDP and CLDAPTCP state exhaustion
Handled by WAAP and Network Protection
Inside a gate
What happens to a packet inside a gate.
Every packet that reaches one of our gates runs through the same set of checks, cheapest first. Most attack traffic never makes it past the first few.
- 01 · Anycast
It lands nearby
Every gate announces the same addresses, so a packet arrives at whichever gate is closest in routing terms. A global botnet gets split eleven ways.
Nothing dropped yet - 02 · Edge lists
Obvious junk goes first
This stage drops packets from sources that can’t exist, for protocols you don’t run and to ports you never opened. It’s the cheapest check, so it runs first.
Bogon sourcesUnused protocolsClosed ports - 03 · Sanity
Broken packets out
Packets with malformed headers, impossible flag combinations or fragments that never reassemble are dropped here, because real software doesn’t send them.
Invalid TCP flagsBad fragmentsMalformed headers - 04 · Signatures
Patterns in the attack
Attack packets usually have something in common, such as a payload, a length, a TTL or a source port, and that pattern becomes a filter while the attack is still running.
Amplification payloadsRepeating patterns - 05 · Reputation
Known troublemakers
Sources far above their normal rate, or already known as part of a botnet, get limited or dropped.
Botnet membersRate outliers - 06 · State
Handshake checks
TCP clients have to complete a proper handshake. Spoofed SYNs can’t, and TLS handshake floods get stopped before they cost your servers any CPU.
Spoofed SYNsHalf-open floodsTLS handshake floods - 07 · Application
WAAP takes a look
For websites and APIs only: WAF rules, bot checks, API schemas and rate limits read the actual requests.
HTTP floodsBad botsExploits - 08 · Delivered
What’s left is real
Clean traffic heads to your origin over HTTPS, a GRE tunnel or a direct cross-connect.
CustomersPlayersAPI clients
Swipe to follow the packet →
Detection
How we tell a flood from a busy day.
A product launch and an HTTP flood can look alike for the first few seconds. We use three methods so that we don’t block your traffic on the busiest day of your year.
Filters written on the fly
When a new attack shows up, the system builds a signature from the attack traffic itself and pushes it to every gate. Nobody has to wake up and write a rule.
Ask before blocking
When we’re not sure about a client, we show it a check instead of blocking it. A browser check takes a person about a second, and most bots never get past it.
Attack coverage
Every attack type we cover.
Network Protection carries any protocol, HTTP included, and filters it at layers 3 to 5. For layer 7 inspection of web traffic, put WAAP in front of your sites and APIs.
| Attack | Layer | Network Protection | WAAP |
|---|---|---|---|
| Network and transport | |||
| ICMP flood | L3 | ||
| IP fragmentation attacks | L3 | ||
| Spoofed and bogon traffic | L3 | ||
| GRE and IP protocol floods | L3 | ||
| Carpet bombing across a prefix | L3 | ||
| SYN flood | L4 | ||
| ACK, RST and FIN floods | L4 | ||
| UDP flood | L4 | ||
| DNS and NTP amplification | L4 | ||
| memcached, SSDP and CLDAP reflection | L4 | ||
| TCP state exhaustion | L4 | ||
| Session | |||
| TLS handshake flood | L5 | ||
| Connection and session exhaustion | L5 | ||
| Application | |||
| HTTP and HTTPS floods | L7 | ||
| HTTP/2 Rapid Reset | L7 | ||
| Slowloris and slow POST | L7 | ||
| SQL injection, XSS and other OWASP Top 10 attacks | L7 | ||
| Credential stuffing and brute force | L7 | ||
| Scraping and inventory hoarding | L7 | ||
| API abuse | L7 | ||
Tell us about attacks that aren’t on the list.
Odd protocols and inventive attackers are the interesting part of this job, and our engineers are happy to look at them.