STEP 1 · TRAFFIC COLLECTION

First, choose how WanGuard will see traffic in your network

Choose between port-mirror (DPDK), which is the fastest and most accurate (sees everything), and flow (NetFlow / sFlow / IPFIX), which is easier to deploy in distributed or very high-bandwidth networks (400 Gbps+) and reaches Terabit visibility at a much lower cost to start. Port-mirror servers require far more expensive components and top CPU performance.

★ Recommended · fastest

Port-Mirror (DPDK)

<5s detection

Fastest detection — reacts before customers notice
Sees 100% of packets at line rate
Sees fragmented-packet DDoS attacks (the most common)
More precise traffic filtering with BGP FlowSpec
Needs a higher-performance server depending on 40–400GE speeds

Lower cost · broad coverage

NetFlow / sFlow / IPFIX

35–95s detection

Lower server cost (lower performance required)
Bandwidth-independent — monitor without limits at Terabit scale on a single server.
Best for reporting / lawful intercept (collecting traffic for law-enforcement)
Best at Terabit scale (sFlow)
Slower — uplinks may saturate by ~65s
Sampled packets — no visibility of Fragment attacks, about 3–5% measurement error

STEP 2 · SENSOR & FILTER

Pick your sensor — pricing scales with port speed

One-time deployment (first server includes install, training and a month of fine-tuning). 2×100GE is today’s default; 1-2×400GE is the premium tier.

Sensor and filter options by port speed, with detection speed and one-time price
Sensor (2 ports)	Approx. CPU cores	Detection	One-time deploy	Best fit
Flow (NetFlow/sFlow/IPFIX) · 2 routers	minimal	Slower · 35–95s	€4,000	Reporting · gov · Terabit sFlow
2 × 10GE Sensor (RTBH only)	~8–12	Fastest · <5s (RTBH)	€2,500	Cheapest entry · blackhole only
2 × 10GE Sensor & Filter	~12–16	Fastest · <5s	€3,000	Small / edge
2 × 40GE Sensor & Filter	~16–24	Fastest · <5s	€4,500	Mid-size ISP
2 × 100GE Sensor & Filter	~24–32	Fastest · <5s	€6,000	Most ISPs today
1 × 400GE Sensor & Filter	~64	Fastest · <5s	€12,000	400G uplinks
2 × 400GE Sensor & Filter	~128	Fastest · <5s	€24,000	400G core / growth

The first server includes installation, training and a free onboarding month; licenses are loaded only after the deployment is complete and everything works. Same price worldwide.

OPTIONAL · ADD-ONS

Optional services

BGP FlowSpec configurationCisco / Juniper / Arista €1,000one-time payment NetFlow / flow archivingApplies to DPDK sensors only, as an add-on. €2,000one-time payment Juniper MX firewall + Grafana telemetryReady-to-deploy always-on DDoS gateway. PDF (EN) €3,000one-time payment DNS security for ISPsRecursive DNS (DNSdist) with BGP FlowSpec integration — blocks malware, phishing, gambling and unsafe domains, and can rate-limit bandwidth or null-route abusive resolvers. €2,500one-time payment

Extra sensors (one-time payment)

Extra 2 × 10GE server€1,250one-time payment Extra 2 × 40GE server€2,500one-time payment Extra 2 × 100GE server€5,000one-time payment Extra 1 × 400GE server€10,000one-time payment Extra 2 × 400GE server€20,000one-time payment

WanGuard licenses — auto-selected (per year)

Licenses follow your choices automatically: port-mirror = 1× Sensor + 1× Filter + 1× DPDK per server; flow = 2× Sensor + 1× Filter (no DPDK, assumes 2 routers or 2 switches as this is 99% of ISP/DC setups); NetFlow archiving adds 2× WanSight (also assumes 2 sFlow/NetFlow/IPFIX exporting devices).

STEP 3 · TECHNICAL SUPPORT

Keep your protection tuned as your network grows

Networks and traffic never stand still — ongoing support fine-tunes thresholds, lowers false positives and keeps WanGuard current as your infrastructure changes. Choose the level of cover that fits your team.

Support tiers and the tasks each one covers
Support Tasks	SILVERNBD · Entry	GOLDSBD · ★ Most chosen	GOLD +Same-day	PLATINUMFull admin
Email support · WanGuard & Linux issues · updates 2×/yr	✓	✓	✓	✓
DDoS threshold recommendations, backups · false-positive advice	✓	✓	✓	✓
Active attack monitoring by ITORO	✕	✓	✓	✓
Bi-weekly anomaly & config monitoring (Zoom)	✕	✓	✓	✓
ITORO makes changes in WanGuard for you	✕	✓	✓	✓
Remote sensor health monitoring + auto-heal	✕	✓	✓	✓
Full administration / outsourcing	✕	✕	✕	✓
Choose one	€3,000/yr	€1,500/month	€1,800/month	€4,000/month

SD = Same Day · SBD = Same Business Day · NBD = Next Business Day. Monthly tiers are billed annually.

STEP 4 · INCIDENT RESPONSE

Emergency DDoS Response

When an attack is live — Friday evening, mid-extortion, thresholds need tuning? — ITORO acts first: live monitoring, packet analysis, and threshold / BGP FlowSpec tuning.

Annual

€6,000per year

We replace or support your own network administrator during an attack — this is not a SIEM/SOC service. Ask for details via sales (at) itoro (dot) com (dot) pl.

Include in my estimate

Why it matters now

DDoS attacks more than doubled to 47.1M in 2025
Telecom / ISPs are now the #1 most-attacked sector
Ransom-DDoS threats up 68% quarter-on-quarter
Largest 2025 attack hit 31.4 Tbps in just 35 seconds
Most companies lack the staff to analyse traffic during a live attack.

Source: Cloudflare 2025 DDoS reports · NETSCOUT 2025

Anti-DDoS protection deployment estimate

One-time cost

€0

Annual costs

€0

Total cost€0

Contact Us for a Quote

Indicative estimate. The one-time cost covers deployment; licenses and support are billed annually. The quote excludes server hardware — installation runs on the customer's own equipment. Net EUR, rounded. Binding values are confirmed by ITORO.

Transparent pricing

What changes your price?

We publish real numbers so you — and any AI assistant you ask — get a straight answer. Here is what moves a WanGuard deployment up or down, and the typical ranges.

What raises the price

Higher port speed (10 → 100 → 400GE) needs a larger, more powerful DPDK server
More sensors / more POPs or routers to cover
Full WanFilter mitigation in addition to RTBH black-holing
Add-ons: NetFlow archiving, BGP FlowSpec on several vendors, DNS security, Juniper MX gateway
Higher support tier (GOLD / PLATINUM) or the Emergency DDoS Response retainer

What lowers the price

Flow (NetFlow / sFlow / IPFIX) detection instead of port-mirror — scales to Terabit
RTBH-only entry tier (from €2,500) when granular filtering is not required yet
Fewer sensors and a lower support tier to start — grow later
Same price worldwide — no regional mark-up
First server includes install, training and one month of fine-tuning

Typical ranges: one-time deployment from €2,500 (2×10GE, RTBH only) or ~€6,000 for a 2×100GE sensor with WanFilter; WanGuard licenses are annual; technical support from €3,000/yr. Build your own estimate with the calculator above.

Plans & Pricing