UDP Amplification Guard
Detects and mitigates DNS, NTP, SSDP, Memcached, and CLDAP amplification vectors. We never leak an amplification vector to your server.
Layer 3Remote DDoS mitigation
Enterprise DDoS protection, purpose-built and always on.
Every component of our filtering engine is developed in-house — no reselling, no third-party black boxes. Attack traffic is absorbed at the edge and stripped by kernel-level XDP filters before it ever reaches your server.
- 30Tbps+ volumetric capacity
- Sub-millisecond overhead
- In-house XDP engine
- 24/7 NOC engineering
- 30Tbps+ Volumetric capacity absorbed at the edge
- <1ms Kernel-bypass filtering overhead
- 36 Points of presence worldwide
- 20+ Countries across 4 continents
- 24/7 NOC engineers on the platform
Mitigation filters
Comprehensive mitigation filters.
Our constantly updated filter library covers every known DDoS attack vector. Each filter is optimised for line-rate processing on our XDP engine.
ICMP Flood Mitigation
Rate-limits ICMP echo requests and blocks oversized ping packets. Prevents Smurf attacks and ICMP-based reconnaissance probes.
Layer 3IP Fragment Attack Filter
Detects fragmented packet abuse and blocks them at line rate. Prevents IP fragmentation attacks and DoS attacks using IP fragmentation.
Layer 3TCP State Validation
Stateful TCP connection tracking that detects and drops ACK floods, RST floods, and out-of-state packets. Enforces proper handshake completion.
Layer 4TCP SYN Flood Protection
Advanced SYN cookie validation with stateful tracking. Drops malformed SYN packets at line rate using XDP hooks before they reach the kernel stack.
Layer 4Adaptive Rate Limiter
Per-source intelligent rate limiting using sliding window counters. Automatically adjusts thresholds based on real-time traffic baseline deviation.
Layer 4SCP: Secret Laboratory
Purpose-built filter for SCP: Secret Laboratory game servers. Validates preauth and challenge packets to block connection floods.
Game & AppRakNet
Purpose-built filter for game servers using RakNet (such as Rust). Validates and challenges packets to block connection floods.
Game & AppWireGuard
Purpose-built filter for WireGuard. Validates packets to block connection floods and ensure you stay connected in the most intense scenarios.
Game & AppA2S Query Caching
Caches Steam A2S responses at the edge. Serves cached responses to legitimate queries while dropping malformed game server probes.
Game & AppARK: Survival Evolved
Purpose-built filter for ARK: Survival Evolved game servers. Validates and challenges packets to block connection floods.
Game & AppSource Engine
Purpose-built filter for game servers using Source (such as Garry's Mod). Validates and challenges packets to block connection floods.
Game & AppMinecraft: Bedrock Edition
Validates Minecraft handshake and login sequences. Blocks bot-join floods, null-ping attacks, and malformed status request storms.
Game & AppOpenVPN
Purpose-built filter for OpenVPN. Validates packets to block connection floods and ensure you stay connected in the most intense scenarios.
Game & AppMinecraft: Java Edition
Validates Minecraft handshake and login sequences. Blocks bot-join floods, null-ping attacks, and malformed status request storms.
Game & AppRDP
Purpose-built filter for Windows' Remote Desktop Protocol. Validates and challenges packets to block connection floods.
Game & AppTeamSpeak 3
Protects against TeamSpeak 3 specific floods and does not interrupt file transfers, even under floods — unlike major providers.
Game & AppWhy NorwichDC
Enterprise DDoS protection, purpose-built.
Every component of our filtering engine is developed in-house. No reselling, no third-party black boxes — we write pure, performant code.
-
In-house filtering engine
We architected our own XDP-based packet processor. No reliance on third parties — we wrote every line of our mitigation stack.
-
20+ countries covered
Our global network provides coverage across 4 continents: North America, Europe, Asia Pacific, and Oceania.
-
Game server specialists
Protocol-aware filters for Minecraft, Source Engine and more. A2S caching and handshake validation built in to keep your server up.
-
Sub-millisecond latency
Kernel-bypass filtering adds less than 1ms overhead. Your players and users never feel the protection layer.
-
Real-time analytics
Live attack dashboards, per-filter hit rates and edge sFlow — all in real time. Full visibility into your traffic.
-
24/7 NOC engineering
Experienced network engineers monitor the platform around the clock. Custom filter deployment within hours, not weeks.
How it works
Attack traffic is dropped before it reaches your server.
Your service sits behind layered filtering. Volumetric floods are absorbed by our upstream prefilter layer, and application-layer attacks are stripped out by kernel-level XDP filters — so only clean traffic ever reaches your origin.
- XDP kernel-bypass filtering. Packets are inspected before they ever reach the kernel stack — millions of packets per second per core.
- Anycast global routing. Traffic routes to the nearest PoP automatically; attacks are absorbed at the edge, close to the source, not at your origin.
- Real-time adaptive response. Thresholds adjust to legitimate traffic baselines, so new attack patterns are mitigated within milliseconds.
Engineered in-house
Built from scratch. Proven at scale.
Our mitigation engine isn't licensed, resold, or assembled from off-the-shelf parts. Every line of code is ours.
-
XDP kernel-bypass filtering
Packets are inspected before they ever reach the kernel stack. Our eBPF/XDP pipeline processes millions of packets per second per core without struggle, keeping your services online.
-
Extensive mitigation profiles
A continuously updated filter library covering every known DDoS vector — from basic volumetric floods to the most advanced application-layer attacks. We stop them reaching your server.
-
Anycast global routing
Traffic automatically routes to the nearest PoP via our extensive Anycast network. Attacks are absorbed at the edge, close to the source — not at your origin — for minimal disruption.
-
Real-time adaptive response
Our engine dynamically adjusts filtering thresholds based on legitimate traffic baselines. New attack patterns are detected and mitigated within milliseconds, not minutes.
Global network
20+ countries. Coverage across 4 continents.
Our mitigation network spans edge metros that scrub and cache traffic, backed by an upstream prefilter layer that absorbs volumetric floods before they reach you. Drag the globe, then click any metro or fibre run to see what it covers.
- 36Points of presence
- 8Edge metros
- 28Upstream prefilter PoPs
- 4Continents covered
- Edge metro
- Upstream metro
- Fibre run
Questions
Remote DDoS mitigation, answered straight.
What does "remote" mitigation mean?
Your service can stay where it is. Traffic is routed through our scrubbing network, cleaned at the edge, and the clean traffic is delivered on to your origin — so you get our filtering without migrating your servers to us.
How much attack traffic can you absorb?
Our upstream prefilter layer provides 30Tbps+ of volumetric capacity, absorbing floods at the edge close to their source before they ever reach your origin.
Will mitigation add latency for my users?
Kernel-bypass XDP filtering adds less than 1ms of overhead, and Anycast routing sends each user to the nearest PoP. Your players and users never feel the protection layer.
Do you support game servers specifically?
Yes. We ship protocol-aware filters for Minecraft (Java & Bedrock), Source Engine, RakNet, ARK, SCP: Secret Laboratory and more, plus A2S query caching and handshake validation built for game traffic.
My attack vector isn't in your list. Can you handle it?
Our filter library is updated continuously and covers every known DDoS vector. If you're seeing something unusual, our NOC engineers can deploy a custom filter within hours, not weeks.
Is the filtering engine really built in-house?
Yes. Our eBPF/XDP mitigation stack isn't licensed, resold, or assembled from off-the-shelf parts — we wrote every line ourselves, which is how we keep it fast and adapt it quickly.
Get started
Under attack, or planning ahead? Talk to our NOC.
Tell us what you're protecting — a game server, an application, or your whole network — and we'll recommend the right filtering profile and routing rather than overselling you capacity you don't need.