The DDoS Defender integrates with the mitigation appliances of multiple vendors and cloud scrubbing services.

• F5 Networks
• Radware
• A10 Networks
• Corsa Networks
• Corero Networks
• NaWas cloud scrubbing service

This is a standard method that mitigates attacks by leveraging advanced traffic filtering at routers. It operates with dynamic attack signatures and triggers actions according to the network traffic. BGP Flowspec rules can be based on:

• Destination prefix
• Source prefix
• IP protocol
• Destination port
• ICMP type
• ICMP code

Feed your log management or SIEM system with comprehensive logging with context-rich syslog or SNMP messages. Maximize visibility across the IT environment or log events into your ticketing tools automatically.

Leverage your existing infrastructure as sensors that generate NetFlow, IPFIX, sFlow, jFlow or NetStream from network devices and other data sources such as public cloud platforms, firewalls, virtualization platforms and packet brokers.

When an event has been detected, Flowmon creates attack patterns and injects them as rules to routers, which can then redirect, forward, drop or rate-limit traffic and more. Rules can be manually adjusted at any given point and all the changes are automatically reverted back after the attack ends.

Flowmon DDoS Defender natively supports all the major vendors in the scrubbing centre market. The configuration itself is a matter of picking the vendor's name from a drop-down menu. Integration with the vendor is always kept up to date.

The DDoS Defender comes as a package with full network performance monitoring and diagnostic functionality. This enables tracking latency degradation, traffic structure analysis for capacity planning, traffic engineering and QoS monitoring.

Divide the traffic into logical portions per tenant, location or network path. All the consecutive detection methods, reporting and triggered actions are set in line with the specific needs for that traffic (blackholing, redirection for scrubbing etc.).

Choose from a variety of options: from an email alert or a syslog message to traffic redirection into a RTBH, 3rd party scrubbing centre; additionally, traffic dropping is an option too, and rate-limiting using BGP Flowspec. Mitigate traffic automatically or manually to ensure no downtimes and latency drops, and create different rules for different tenants or types of traffic.

The system learns traffic patterns for different protocols and creates adaptive baselines. Two baselines are modelled: suspicion of an attack and an actual attack. This off-the-shelf functionality ensures real-time detection with a low number of false positives.