€100 welcome bonus a code for your next order, after your first renewal How the bonus works
DDoS protection, included with every server
Our filter is an eBPF program attached to the receive path of every network card in the Sofia scrubbing cluster. A packet is classified and dropped before the kernel allocates a buffer for it. That is why a drop costs nanoseconds, and why capacity is measured in a hundred million packets per second per server and a billion per cluster.
Most providers inspect traffic after the operating system has already paid for it. We attach to the driver receive path, so a dropped packet costs a few nanoseconds and never touches the stack. The filter is our own code, written and run by the engineers who answer your ticket, not a scrubbing service bought from another company.
The filter is an eBPF program on the receive path of an NVIDIA ConnectX-8 or BlueField-3 adapter, 400G each. A packet is classified and dropped before a socket buffer is ever allocated; everything the kernel does is still there for the traffic we keep.
At least ten Dell PowerEdge R670 filtering servers per cluster, load shared by weighted ECMP. Each holds its proportional share of every budget, so the group enforces the figure that is written down. Adding a server raises capacity without loosening a single limit.
The filter can be replaced while traffic is flowing, without dropping a packet and without losing connection state. A new attack vector is a rule written, verified and loaded. It is not a firmware release, a maintenance window or a support case with a vendor.
Amplification and reflection floods dropped at the cluster your server hangs off. Capacity is per cluster, not pooled across a region.
SYN cookies, connection tracking and rate limits keyed on the TCP option fingerprint, so a flood is separated from a busy server.
Payload judged on its bytes, never on its port number. A DNS reply is recognised as DNS wherever it arrives; Source engine, RakNet, SIP and RTP are recognised as themselves.
Policy
A prefix under attack keeps being announced and keeps being reachable. Dropping a customer off the internet to save the network is not mitigation, it is the attacker's objective reached by other means, and it is the one thing we have never done.
| Handshake | SYN flood, SYN+ACK flood, ACK+PSH flood, FIN flood, RESET flood |
|---|---|
| Malformed | Fragmented ACK, TCP fragments, invalid MSS, invalid WIN, invalid SEQ, stateful check failures |
| Behaviour | Connection flood, low-rate attacks, booter TCP floods, LOIC and similar tooling |
| Floods | UDP flood, carpet bombing across a prefix, UDP null packets, invalid checksum, invalid packet size, invalid TTL, hping3 and booter scripts |
|---|---|
| Reflection | DNS, NTP, SSDP, CLDAP, memcached, chargen, SNMP, Portmap/rpcbind, MS-SQL, TFTP, RIP, BitTorrent, WSD, CoAP, NetBIOS |
| Network layer | IP spoofed packets, ICMP flood, ICMP port unreachable, Smurf, ping of death, Teardrop, IP fragment floods, SIP attacks, IPsec attacks |
|---|---|
| Game protocols | Source engine query floods, RakNet/Minecraft floods, FiveM and voice-service floods |
Topology
The scrubbing cluster in Sofia sits in the same network as your server, behind the same Juniper MX304 border routers and QFX10008 fabric. There is no tunnel to a scrubbing centre elsewhere, no BGP diversion when an attack starts and no re-convergence when it stops. The filter is on the path your traffic already takes, so the only latency it adds is the nanoseconds of the decision. Our network runs five more scrubbing clusters (London, Amsterdam, Frankfurt, Marseille, Bucharest) and four edge nodes (Bratislava, Budapest, Thessaloniki, Istanbul) over our own EVPN-MPLS backbone on our own DWDM wavelengths; an attack arriving at any of them is dropped at the nearest cluster before it ever heads for Sofia.
Every mitigation leaves a record: which rule fired, what threshold it crossed, what the traffic was made of, and a packet capture you can open in your own tools without taking our word for any of it. Today it comes by ticket from the engineer who handled the incident, not from a panel or an autoresponder.
Which rule fired, what its threshold was and by how much it was exceeded. You get the actual number and the actual limit instead of a severity colour, so you can tell a rule that was nearly wrong from one that was obviously right.
Protocols, source and destination ports, packet sizes, TTL distribution, fragment share and how many distinct sources and networks were sampled. Enough to tell spoofing from a botnet without asking us.
A packet capture in ordinary pcap format, openable in Wireshark or tcpdump. We would rather you checked. An operator that shows you only its own summary is asking you to trust the summary.
Start, end, duration and burst count, measured from when traffic crossed the threshold rather than from when somebody noticed. A pulse-wave attack that stops and returns eleven times is one incident with eleven bursts, not eleven incidents.
It does not start. It is already running. Filtering is permanently in the path, so there is no activation, no diversion and no BGP convergence to wait out. A new vector goes from first packet to enforced rule in under a second.
Nanoseconds. The decision happens in the NIC driver before the kernel allocates memory for the packet, and there is no scrubbing-centre detour because there is no detour at all: the filter sits on the path your traffic already takes.
As our own mitigation step, never. Blackholing completes the attack, so our escalation path ends in a tighter filter, not in your address disappearing.
Included and always on from the day the server is handed over, with nothing to switch on. No per-incident invoice, no surge pricing. Attack traffic is never billed, because charging you for being attacked would make us a beneficiary of the attack.
That traffic is why the filter judges packets by their bytes, never by their port. Source engine, RakNet, SIP and RTP are recognised as themselves, and thresholds are set against your measured baseline rather than an industry default.
Not for a server in our racks. The scrubbing cluster is on-net in Sofia, so there is nothing to divert and nothing to tunnel. Tunnels (GRE, IPIP, VXLAN) are for the case where you also want servers at another provider behind the same filter.
An incident record: which rule fired, what threshold it crossed, what the traffic was made of, and a packet capture you can open in Wireshark. We would rather you checked than trusted.
Peak pps, peak Gbps, what the previous provider did about it. An engineer answers with what the Sofia cluster would have done instead, and the thresholds we would set against your normal traffic.