Seven Tier 1 carriers, side by side
Arelion, Lumen, NTT, GTT, Tata, Orange and Sparkle carry our traffic, with Cogent, Hurricane Electric and RETN beside them. When one of them is slow to a destination, the others already have a route there.
Our own network, Sofia
A Tier 2 network, and that is deliberate.
Very low latency across Europe, by design: we are the hosting company with the most presence at European internet exchanges. A Tier 1 carrier sells you its single view of the internet; we buy transit from ten carriers, seven of them Tier 1, and peer at 25+ exchanges, so for any destination there are several ways to get there and our own routing logic chooses between them, continuously.
10 carriersGTT, NTT, Cogent, Tata, Orange, HE, Sparkle, Arelion, Lumen, RETN
25+ IXPsthousands of peering sessions across Europe
100+ PNI portsdirect into Google, Meta, AWS, Cloudflare, Akamai and the other heavy networks
Own backboneour own network and IP space, no reseller in between
Why a Tier 2 network is quicker than a Tier 1
A Tier 1 carrier reaches the rest of the internet through its own network and its own peers, and that is all it can sell you. A Tier 2 network buys from several of them and peers directly with everyone else, so for each destination it can take whichever path is quickest at the moment. That is the network we built.
Tier 1 carriers meet each other at their own pace
They exchange traffic over settlement-free links, and when one of those fills up at the evening peak, or a dispute between two carriers cuts it, neither is in a hurry to pay for more capacity. A customer of one Tier 1 waits with it. We move the traffic to another carrier the same day.
Much of the traffic never needs a carrier
Tier 1 carriers peer selectively, mostly with networks of their own size. We peer at 25+ exchanges and run 100+ direct ports into Google, Meta, AWS, Cloudflare and the other heavy networks, so traffic to them and to the access networks at the exchanges goes there directly.
Routing
The shortest path that is actually fastest.
BGP picks the fewest autonomous systems, which is not the same thing as the quickest route and frequently is not even close. We measure the paths we hold (latency, loss and jitter per destination network, across every available path) and prefer the one that is performing, including at peak, over the one that looks tidiest in the table. Loss on a transit path is almost never a fault; it is a peering dispute or a saturated port somebody else is not in a hurry to upgrade. Holding ten upstreams means we route around it the same day rather than opening a ticket and waiting.
Measured, not marketed
Two kinds of figure, kept apart on purpose: what we measure, and what we have built capacity for.
transit 10
transit carriers behind every site
peering 25+
internet exchanges on-net
pni 100+
direct PNI ports into content and cloud networks
sessions 1000+
peering sessions
transit 5 Tbps
transit capacity
peering 15 Tbps
internet exchange and private peering capacity
backbone 50 Tbps
between points of presence, on our own DWDM wavelengths
sofia 4 Tbps, 1000M pps
filtering capacity of the Sofia scrubbing cluster
Transit upstreams
| GTT | AS3257 |
|---|---|
| NTT | AS2914 |
| Cogent | AS174 |
| Tata Communications | AS6453 |
| Orange | AS5511 |
| Hurricane Electric | AS6939 |
| Sparkle | AS6762 |
| Arelion | AS1299 |
| Lumen | AS3356 |
| RETN | AS9002 |
Internet exchanges
Across them we hold thousands of peering sessions. The exchanges are where the long tail of the internet is reached directly.
AMS-IXDE-CIXLINXGNM-IXBIX.BGFRYS-IXSPEED-IXGigaNetInterLANGlobal-IXNINE-IXPiter-IXERA-IXLSIXpeering.czSIX.SKGR-IXEquinix IXInterIXTurkIX
Private interconnection
The heaviest destinations do not ride transit at all. We run hundreds of direct PNI ports into the content, cloud and hosting networks that carry most of the traffic: a private cable to each, at every point of presence where they meet us. A PNI is a port nobody else's congestion can touch: no shared exchange fabric, no transit path, one cable between two routers. It is why traffic to these networks stays flat on the evening the rest of the internet is busy.
GoogleMetaAWSMicrosoftAppleNetflixCloudflareAkamaiFastlyCDN77ByteDanceOVHcloudHetznerLeasewebDigitalOcean
Our own edge, not a rented uplink
Own AS, own IP space
We announce our prefixes ourselves, from our own RIPE allocations, checked against blocklists and reputation feeds before you touch them. Addresses stay yours across a hardware swap and reverse DNS is yours to set, at no charge. Bring your own ASN and PI space and we announce them for you; if you do not have them yet we act as sponsoring LIR and get you an AS number of your own within days, with provider-independent IPv6 alongside it.
Nothing in the path is singular
At least two Juniper MX304 routers and two QFX10008 switches at every site, EVPN-MPLS underneath. A failed link, line card or chassis is a re-convergence, not an outage, and a chassis can be taken out for an upgrade during working hours without the site losing traffic. Identical hardware and software at all ten sites.
Backbone we light ourselves
The spans between the ten sites ride DWDM wavelengths we light on our own line system, Nx100G per corridor. Sofia has direct spans to Frankfurt, Budapest, Bucharest, Thessaloniki and Istanbul. Fifty terabits between points of presence, so an attack arriving at any edge is dropped at the nearest cluster before it ever heads for Sofia.
What happens when something breaks
01
99.99% SLA, if you want it in the contract
An optional SLA at 20% on the monthly writes 99.99% monthly availability into your contract, with service credits when we miss it. It rests on hardware, not on a promise: two or more MX304 and two or more QFX10008 at the edge, ten transit carriers, so no single carrier failure is an outage. Ask for the SLA document before you sign; details at /sla.
02
On-net DDoS scrubbing
Mitigation runs inside our network on our own kit: an XDP/eBPF filter in the NIC driver of the Sofia scrubbing cluster, ten or more Dell R670 at 400G each. Filtering is permanently in the path, on every server, with thresholds set against your measured traffic, so there is no activation, no diversion and no BGP convergence to wait out. A new vector goes from first packet to enforced rule in under a second.
03
Maintenance, announced
Planned work is announced to the technical contact on the account ahead of time, with the affected devices named. After an attack you get the incident record: rule, thresholds, composition and the pcap.
Questions engineers ask about the network
Network questions
Why Tier 2 and not Tier 1?
Because a Tier 1 carrier can only give you its own routes. We buy transit from seven Tier 1 carriers and three more large ones, and peer at 25+ exchanges and over 100+ direct ports, so for every destination there are several paths and we use the quickest one that is working. If the link between two Tier 1 carriers is full at peak, or cut by a dispute, a customer of one of them waits; our traffic takes another carrier.
Do you support IPv6?
Dual stack on the same BGP session, by default, at no surcharge. RPKI origin validation runs on every session, and invalids are dropped, not de-preferenced.
Can I bring my own ASN and IP space?
Yes. We announce your prefixes from our network, behind the same filter as everything else. If you do not have them yet, we act as sponsoring LIR: an AS number and PI IPv6 registered to you within days, RPKI ROAs and reverse DNS at no charge. Because they are registered to you, leaving any provider, including us, is one BGP session.
Can I get more IPv4?
Not from the free pool. It ran out in November 2019 and the waiting list is measured in years. Realistic options are renting from our allocations, at €2 a month for each address beyond the one included, up to 15 on a server, or €199 a month for a /24 routed to a ready server, or buying on the transfer market, where we broker and handle the RIPE paperwork.
Will you ever null-route my server?
As our own mitigation step, never. Blackholing completes the attack, so our escalation path ends in a tighter filter, not in your address disappearing.
Check the path to your users before you buy.
Send the ASN or the prefix you deliver to. We will tell you how we reach it from Sofia (a PNI, an exchange or which of the ten carriers) and what the measured latency is.