Foire aux questions (FAQ) sur la protection DDoS
FAQ
What hardware is needed to protect my network?
- Router BGP.
- Router or switch with feature to mirror traffic or NetFlow.
- Server for WanGuard installation.
Additional server specs are below.
What does ITORO provide?
- ITORO can provide you with knowledge and very fast installation for blackholing or filtering DDoS attacks.
- Our experience and our Adrisoft partnership gives us an ultimate in-depth understanding, allowing us to fine tune your setup for best performance and lowest latency in response to any threat.
- We guide you through the whole process and answer any questions that may arise, empowering you to become a DDoS ninja for your network.
Why port mirror is better than flow monitoring?
Mirroring of traffic gives an almost instant response compared to Netflow. Netflow data is aggregated on a router/switch and then processed to WanGuard. Short pulse attacks (shorter than 30 seconds) can reach your network before Netflow and BGP Blackholing can act.
What payment methods do you accept at ITORO?
ITORO accepts Bank wire transfer. We require all international transfers to us to be made with the OUR instruction (You pay all transfer charges. We receive the exact invoiced amount).
What is the recommended server requirements for WanGuard server with 1x10GE Sensor:
WanGuard with 1x10GE traffic mirroring port:
Processor: Intel XEON E3-1220 (4 cores 3.1 GHz)
HDDs: 1xSSD for Debian or RAID 1 for 2 SSDs, 1 SSD for WanGuard graphs
RAM: 32 GB RAM
Those specs may vary depending on :
- traffic volumes and packets per seconds
- traffic capture engine (PF_RING, DPDK, libpcap etc)
- settings applied to WanGuard
Intel XEON Processors table chart
AMD processors are also supported. You may compare AMD vs Intel models and choose similar model based on performance.
For this task, we recommend CPU Boss site
Before buying a server for Your WanGuard contact us.
What is the recommended server requirements for WanGuard server with 2x10GE and 2x Sensor:
Processor: Intel XEON E5-4627 v2 (8 cores 3.3 GHz)
HDDs: 1xSSD for Debian or RAID 1 for 2xSSDs, 1 SSD for WanGuard graphs
RAM: 32 GB RAM.
Those specs may vary depending on :
- traffic volumes and packets per seconds;
- traffic capture engine (PF_RING, DPDK, libpcap etc.);
- settings applied to WanGuard.
How fast can WanGuard detect a DDoS attack?
With port-mirror (DPDK) detection WanGuard reacts in under 5 seconds, because it inspects 100% of packets at line rate. Flow-based detection (NetFlow / sFlow / IPFIX) is cheaper and covers many routers but reacts in roughly 35–95 seconds, by which time a large uplink may already be saturated. To stop attacks before customers notice, ITORO recommends port-mirror.
What is the difference between port-mirror (DPDK) and NetFlow / sFlow detection?
Port-mirror copies real traffic to a DPDK sensor that inspects every packet — fastest (under 5s), most granular, ideal for carpet-bomb and volumetric floods, but it needs a dedicated server sized to your 10–400GE ports. Flow (NetFlow / sFlow / IPFIX) samples traffic exported by routers — much cheaper, bandwidth-independent, can cover many POPs and scale to Terabit with sFlow, but it is sampled, coarse and slower to react.
Can you deploy DDoS protection during an active attack?
Yes. If your server and router are prepared in advance (RTBH and/or BGP FlowSpec ready), ITORO can bring WanGuard protection online in as little as 2 hours during a live attack. If nothing is prepared yet, follow our readiness checklist so you are ready when it happens.
How much does WanGuard DDoS protection cost?
One-time deployment starts around €2,500 for a 2×10GE port-mirror sensor that triggers RTBH only, and from €3,000 with WanFilter mitigation; larger 100GE / 400GE sensors scale up with server size. WanGuard licences are annual (Sensor, Filter, DPDK Engine, WanSight) and ongoing technical support runs from €3,000/yr. Use the calculator on our Plans & Pricing page for an itemised estimate.
What is BGP FlowSpec and how does it stop DDoS?
BGP FlowSpec distributes fine-grained filtering rules (matching source and destination, ports, protocol, packet length and more) to your routers over BGP, so attack traffic is dropped or rate-limited at the network edge instead of on the target. WanGuard generates these rules automatically when it detects an attack. It works with Juniper, Cisco, Arista and other FlowSpec-capable platforms.
What is RTBH (Remote Triggered Black Hole) filtering?
RTBH uses BGP to null-route traffic to an attacked IP, dropping it upstream before it saturates your links. It is the cheapest and most widely supported mitigation, but it blocks all traffic to that IP. WanGuard can trigger RTBH automatically and, where you need to keep the service online, escalate to granular BGP FlowSpec or WanFilter filtering instead.
Do I need a Juniper MX router to use WanGuard?
No — WanGuard works with any FlowSpec / RTBH-capable router. That said, a Juniper MX makes an excellent always-on filtering gateway: it drops attack traffic at line rate while WanGuard handles detection and dynamic rules. ITORO offers a ready-to-deploy Juniper MX + WanGuard gateway with Grafana telemetry.
Can WanGuard scale to Terabit-level traffic?
Yes. For very high aggregate volumes, flow-based detection with sFlow scales to Terabit across many routers at low cost. For the fastest per-packet reaction on individual 100–400GE links, DPDK port-mirror sensors are used. ITORO designs the mix that fits your topology.
Is WanGuard a cloud scrubbing service?
No. WanGuard is on-premise, self-hosted software that runs on your own servers, so you keep full control of your traffic and data — no rerouting to a third-party scrubbing center and no per-Gbps cloud fees. ITORO installs, tunes and supports it on your infrastructure.
Does NIS2 require DDoS protection?
The EU NIS2 Directive (2022/2555) requires essential and important entities — including ISPs, telecoms and digital infrastructure — to take appropriate technical measures against availability threats such as DDoS (Article 21) and to report significant incidents within 24h / 72h / 1 month (Article 23). ITORO covers the resilience side with WanGuard detection, BGP FlowSpec / RTBH mitigation and the incident reports you need.
What server do I need for a DPDK sensor at 100GE or 400GE?
As a guide, a 2×10GE port-mirror sensor needs roughly 12–16 CPU cores, 2×40GE about 16–24, 2×100GE about 24–32, and 1×400GE around 64 cores, with matching NIC and memory. ITORO specifies and tunes the BIOS, OS and NICs as part of deployment so the sensor keeps up at line rate.
Which routers and vendors do you support for FlowSpec and RTBH?
ITORO configures BGP RTBH and BGP FlowSpec on the major platforms — Juniper, Cisco, Arista and other FlowSpec-capable routers — and integrates them with WanGuard so mitigation triggers automatically. We also build DNS security (DNSdist) with BGP FlowSpec integration for ISPs.