SYN proxy
Every TCP service
SYN cookies validate the connection before anything is forwarded, so a flood never reaches the backend’s connection table.
Wholesale DDoS mitigation
Mitigation that doesn’t guess.
Detection has to recognise an attack before it can stop one, so anything novel gets through the first time. We invert that: every packet is validated against what your protocol legitimately expects, and whatever cannot satisfy that check is dropped — seen before or not.
Inbound — validated per packetRejectedDelivered
- 13+ Tbps
- In-house stateful filtering
- 500+ Tbps
- Volumetric, via transit partners
- 29
- Points of presence
- 5
- Regions
Most of this happens on ordinary days.
There is no attack mode to enter and no threshold to cross.
There is no attack mode to enter and no threshold to cross. Filtering runs inline on every packet at the edge it arrives on, so the response to a flood is not a decision made after the fact — it is the same validation that was already happening. Nothing has to be recognised first, which is why a novel vector is not a free hit.
Each game filter holds connection state and checks packets for sequence and state consistency, not merely for shape. Forged connection floods are dropped at the edge without ever touching the session table on the server, and real players are never challenged or rerouted to prove they are real.
Adaptive UDP
The long tail
Behavioural filtering for services with no protocol-specific filter yet.
Amplification
Reflection and abuse
The bulk of everyday noise never reaches your capacity at all.
IP and geo firewall
Policy, not floods
For traffic that is unwanted rather than hostile — by address, ASN or country.
Three ways generic filtering fails a game host
A host does not lose customers to a slow control panel. It loses them the evening a community's server drops out of the browser mid-raid.
It delists you
Query traffic gets rate-limited along with the attack, Steam stops getting answers, and the server disappears from the browser. The attack ends; the listing does not come back for hours.
It adds latency to everyone
Challenge-response and reroute-on-detect protect the box by degrading the session. For a shooter, added jitter is indistinguishable from the outage it prevented.
It has never seen your protocol
A generic UDP filter cannot tell a valid RakNet handshake from a forged one, so it either passes the flood or drops real players. Both look like your fault to the customer.
33 filters, written per protocol
A signature list only knows attacks it has already seen. Each of these encodes what its protocol legitimately does.
Full matrix ›4
Always-on network filtering
The everyday routines. These run inline on every packet, all the time, rather than switching on once something has been recognised as an attack — which is what makes the first novel flood as survivable as the hundredth familiar one.
23
Stateful layer 7 game filters
One filter per protocol, each holding connection state and validating packets against what that protocol legitimately does. This is the part a generic scrubber cannot do: it has no way to tell a valid handshake from a well-formed forgery.
6
Service and tunnel protocols
Infrastructure that sits beside the game fleet and gets attacked the same way — voice, remote access, resolvers and tunnels, each of which looks opaque to a filter that does not know the protocol.
Priced per deployment, not per plan
What you pay turns on committed capacity, how many sites you terminate in, and whether the filtering runs on our hardware or yours.
Remote mitigation
For operators who want clean traffic delivered and no hardware to rack. Anycast ingress, scrubbed at the edge, returned over GRE or BGP.
Priced on committed capacity
Billed monthly — no per-attack charges
- Automatic nearest-PoP routing
- GRE tunnels or direct cross-connect
- Every game-protocol filter included
- Real-time attack dashboard and API
On-premise & whitelabel
your brandFor operators who need the traffic to stay on their own network — or need the mitigation to carry their own name in front of their customers.
Priced per appliance
1U/2U — plus optional cloud offload
- Our appliances or your own hardware
- Traffic never leaves your network
- Full branding control, end to end
- Dedicated engineering support
Four things and we can quote
- 01Protocols and titles you carryWhich games, and whether any are custom UDP.
- 02Clean-traffic commitSustained Gbps you actually push, not peak.
- 03Where you terminateYour sites, so we can pick ingress PoPs.
- 04Worst attack you have takenSize and vector, if you have the capture.
Tell us what you're defending.
Protocols, peak attack you've taken, and where your capacity sits. We'll size the deployment against that, not against a plan tier.