What Is the Difference Between Wanguard and Wansight?

Wanguard and Wansight are two products from Andrisoft that share the same Linux packages, the same Sensors, and the same Console — the difference is what the license key turns on. Wanguard adds DDoS detection and mitigation on top of traffic monitoring; Wansight is the monitoring-only version. If you need to stop attacks, you want Wanguard. If you only need bandwidth graphs, top talkers, forensics, and 95th-percentile billing, Wansight covers it — and it can become Wanguard later with a key.

The core difference: mitigation

Both products run on your own servers as Linux packages, with no appliance in the path and no traffic leaving your network. What separates them is whether the software acts on what it sees.

Wansight is described as Wanguard's "traffic-monitoring sibling" — the same Sensors and Console without detection and mitigation. That means the monitoring capabilities are not a reduced version; they are the same features, minus the security layer.

What Wanguard adds

Wanguard is positioned as on-premise DDoS detection and mitigation software. Two capabilities sit on top of the shared monitoring base:

• Detection in seconds. Flow and Packet Sensors analyze NetFlow, sFlow, IPFIX, or mirrored packets, and anomaly checks run every second.
• On-premise mitigation. Filters scrub diverted attack traffic at line rate on Linux servers, or your routers handle it via Flowspec and RTBH.

So the detection and mitigation work happens on infrastructure you control, rather than being outsourced to a scrubbing provider.

What Wansight covers

Wansight is the same stack without detection and mitigation. Its focus is visibility and accounting:

• Bandwidth graphs for hundreds of thousands of IPs
• Top talkers
• Flow and packet forensics, including an optional Flow Collector with interactive flow graphs and packet captures in a Wireshark-like viewer
• 95th-percentile accounting for invoicing

If your goal is to understand and bill for traffic rather than defend against attacks, this is the relevant set of features.

How to choose

The decision comes down to one question: do you need to detect and stop attacks, or only to see and account for traffic?

• Choose Wanguard if you need DDoS detection and mitigation on your own network — for example, if you operate routers you can steer traffic to via Flowspec or RTBH, or Linux filtering servers that can scrub diverted traffic.
• Choose Wansight if you need bandwidth graphs, top talkers, forensics, and 95th-percentile billing, but not attack mitigation — for example, for capacity planning or customer invoicing.
• Start with Wansight and upgrade if you are unsure. Because Wansight becomes Wanguard with a key, you are not locked into the monitoring-only product if your needs change.

Licensing and trying it

Sensor licenses are listed at $595 a year, with volume discounts, and the Console is free. A free 30-day trial license key is available. Wansight and Wanguard share the same Sensors and Console, so the licensing model follows the same components rather than being split into two unrelated product lines.

Andrisoft has been building this software since 2006, is EU-based, and reports 1,000+ network operators in 50+ countries. The current Wanguard release is listed as 9.0, July 2026.