How Andrisoft's On-Premise DDoS Detection and Mitigation Works

Updated

Andrisoft's Wanguard detects DDoS attacks by having Sensors continuously analyze NetFlow, sFlow, IPFIX, or mirrored packets, running anomaly checks every second, then mitigates on your own network — either by instructing your routers via Flowspec or RTBH, or by scrubbing traffic on Linux filtering servers. It runs as Linux packages on commodity 64-bit Intel or AMD hardware, with no appliance in the traffic path and no traffic leaving your network. This suits network operators who want attack detection in seconds, control over their own mitigation, and no per-gigabit fees.

The two halves: Sensors and Console

Wanguard splits into components that report to a single Console:

  • Sensors watch traffic. Flow Sensors analyze flow exports (NetFlow, sFlow, IPFIX); Packet Sensors analyze mirrored packets. Anomaly checks run every second, which is how detection reaches "seconds" rather than minutes.
  • Console is the central management and reporting layer. It is free; a license key decides which capabilities are switched on across the same Linux packages.

The same Sensor and Console packages also power Wansight, the traffic-monitoring sibling. Wansight gives bandwidth graphs, top talkers, flow and packet forensics, and 95th-percentile billing — without detection and mitigation. It becomes Wanguard when you apply a key.

How detection turns into mitigation

Once a Sensor flags an anomaly, mitigation happens on infrastructure you already control, in one of two ways:

  1. Router-side mitigation — Wanguard signals your routers to drop or redirect attack traffic using Flowspec or RTBH (Remotely Triggered Black Hole). No scrubbing hardware is needed; your existing routers enforce the response.
  2. Filtering servers — a Wanguard Filter scrubs diverted attack traffic at line rate on Linux servers. This is the option when you want to clean traffic before it reaches the destination rather than blackhole it.

Because both paths run inside your network, attack traffic is not handed to a third-party scrubbing center, and there is no per-gigabit scrubbing fee.

What "on-premise" changes for you

Aspect On-premise (Wanguard)
Where traffic goes Stays in your network; nothing is diverted to a vendor
Hardware Any 64-bit Intel or AMD server; tested NICs for 10–100 Gbps
Cost model Sensor licenses, e.g. $595/year with volume discounts; Console free
Detection speed Anomaly checks every second
Mitigation Your routers (Flowspec/RTBH) or your Linux filtering servers

Virtual machines are described as suitable for trials only, so production sizing should follow the per-component sizing guidance and tested network cards.

Deciding whether it fits

Choose the on-premise model if you want detection in seconds, mitigation you control, and no traffic leaving your network or per-gigabit fees. If you only need visibility — bandwidth graphs, top talkers, forensics, 95th-percentile accounting — Wansight covers that and can be upgraded to Wanguard with a key. Andrisoft has offered this since 2006, is EU-based, and reports 1,000+ network operators across 50+ countries; a free 30-day trial key is available to evaluate it on your own servers.