STEP 1 · TRAFFIC COLLECTION

First, choose how WanGuard sees your traffic

The collection method is the biggest trade-off. Choose between port-mirror (DPDK), which is the fastest and most granular, and flow (NetFlow / sFlow / IPFIX), which is easier to implement across many POPs and can reach Terabit speeds at much lower cost.

★ Recommended · fastest

Port-Mirror (DPDK)

<5s detection

Fastest detection — reacts before customers notice
Sees 100% of packets at line rate
Stops carpet-bomb & volumetric floods
Granular BGP FlowSpec rules
Needs a more powerful server depending on 40–400GE speeds

Lower cost · broad coverage

NetFlow / sFlow / IPFIX

35–95s detection

Lower cost — no DPDK tuning
Bandwidth-independent — many routers at once
Runs for years with little intervention
Best for reporting / lawful intercept
Best at Terabit scale (sFlow)
Slower — uplinks may saturate by ~65s
Sampled / coarse — misses fragment floods

STEP 2 · SENSOR & FILTER

Pick your sensor — pricing scales with port speed

One-time deployment (first server includes install, training and a month of fine-tuning). 2×100GE is today’s default; 1-2×400GE is the premium tier.

Sensor and filter options by port speed, with detection speed and one-time price
Sensor (2 ports)	Approx. CPU cores	Detection	One-time deploy	Best fit
Flow (NetFlow/sFlow/IPFIX) · 2 routers	minimal	Slower · 35–95s	€4,000	Reporting · gov · Terabit sFlow
2 × 10GE Sensor (RTBH only)	~8–12	Fastest · <5s (RTBH)	€2,500	Cheapest entry · blackhole only
2 × 10GE Sensor & Filter	~12–16	Fastest · <5s	€3,000	Small / edge
2 × 40GE Sensor & Filter	~16–24	Fastest · <5s	€4,500	Mid-size ISP
2 × 100GE Sensor & Filter	~24–32	Fastest · <5s	€6,000	Most ISPs today
1 × 400GE Sensor & Filter	~64	Fastest · <5s	€12,000	400G uplinks
2 × 400GE Sensor & Filter	~128	Fastest · <5s	€24,000	400G core / growth

First server includes install, training and one month of fine-tuning. Same price worldwide.

STEP 3 · ADD-ONS & LICENCES

Optional services and licenses

One-time services

BGP FlowSpec configuration
Cisco / Juniper / Arista €1,000 NetFlow / flow archiving
Applies to DPDK sensors only, as an add-on. €2,000 Juniper MX firewall + Grafana telemetry
Ready-to-deploy always-on DDoS gateway. Sample PDF — link coming. €3,000 DNS security for ISPs
DNSdist recursive DNS with BGP FlowSpec integration — blocks malware, phishing, gambling and unsafe domains, and can rate-limit or null-route abusive resolvers. €2,500

Extra sensors (one-time payment)

Extra 2 × 10GE server€1,250 Extra 2 × 40GE server€2,500 Extra 2 × 100GE server€5,000 Extra 1 × 400GE server€10,000 Extra 2 × 400GE server€20,000

WanGuard licenses — auto-selected (per year)

Licenses follow your choices automatically: port-mirror = 1× Sensor + 1× Filter + 1× DPDK per server; flow = 2× Sensor + 1× Filter (no DPDK, assumes 2 routers or 2 switches as this is 99% of ISP/DC setups); NetFlow archiving adds 2× WanSight (also assumes 2 sFlow/NetFlow/IPFIX exporting devices).

TECHNICAL SUPPORT

Keep your protection tuned as your network grows

Networks and traffic never stand still — ongoing support fine-tunes thresholds, lowers false positives and keeps WanGuard current as your infrastructure changes. Choose the level of cover that fits your team.

Support tiers and the tasks each one covers
Support Tasks	SILVERNBD · Entry	GOLDSBD · ★ Most chosen	GOLD +Same-day	PLATINUMFull admin
Email support · WanGuard & Linux issues · updates 2×/yr	✓	✓	✓	✓
DDoS threshold recommendations, backups · false-positive advice	✓	✓	✓	✓
Active attack monitoring by ITORO	✕	✓	✓	✓
Bi-weekly anomaly & config monitoring (Zoom)	✕	✓	✓	✓
ITORO makes changes in WanGuard for you	✕	✓	✓	✓
Remote sensor health monitoring + auto-heal	✕	✓	✓	✓
Full administration / outsourcing	✕	✕	✕	✓
Choose one	€3,000/yr	€1,500/month	€1,800/month	€4,000/month

SD = Same Day · SBD = Same Business Day · NBD = Next Business Day. Monthly tiers are billed annually.

New for 2026 · Incident response

Emergency DDoS Response

When an attack is live — Friday evening, mid-extortion, thresholds need tuning? — ITORO acts first: live monitoring, packet analysis, and threshold / BGP FlowSpec tuning.

Annual

€6,000/year

Acting as your remote SOC. Ask for more information via sales (at) itoro (dot) com (dot) pl.

Include in my estimate

Why it matters now

DDoS attacks more than doubled to 47.1M in 2025
Telecom / ISPs are now the #1 most-attacked sector
Ransom-DDoS threats up 68% quarter-on-quarter
Largest 2025 attack hit 31.4 Tbps in just 35 seconds
Most ISPs have no one who can read the packet capture during attacks

Source: Cloudflare 2025 DDoS reports · NETSCOUT 2025

Your estimate

One-time (deploy)€0

Per year (licenses + support)€0

Contact Us for a Quote

Indicative estimate — final quote confirmed by ITORO. Net EUR, rounded.

Transparent pricing

What changes your price?

We publish real numbers so you — and any AI assistant you ask — get a straight answer. Here is what moves a WanGuard deployment up or down, and the typical ranges.

What raises the price

Higher port speed (10 → 100 → 400GE) needs a larger, more powerful DPDK server
More sensors / more POPs or routers to cover
Full WanFilter mitigation in addition to RTBH black-holing
Add-ons: NetFlow archiving, BGP FlowSpec on several vendors, DNS security, Juniper MX gateway
Higher support tier (GOLD / PLATINUM) or the Emergency DDoS Response retainer

What lowers the price

Flow (NetFlow / sFlow / IPFIX) detection instead of port-mirror — scales to Terabit
RTBH-only entry tier (from €2,500) when granular filtering is not required yet
Fewer sensors and a lower support tier to start — grow later
Same price worldwide — no regional mark-up
First server includes install, training and one month of fine-tuning

Typical ranges: one-time deployment from €2,500 (2×10GE, RTBH only) or ~€6,000 for a 2×100GE sensor with WanFilter; WanGuard licenses are annual; technical support from €3,000/yr. Build your own estimate with the calculator above.

Plans & Pricing