Network protection
Always-on scrubbing for entire IP ranges.
Orbitel Shield announces your prefixes over BGP, so traffic for every address in them lands on our edge first. Attacks are dropped there, and only clean traffic travels on to your network.
- IPv4 /24 and IPv6 /48
- Filtered in under a second
- Attack traffic never billed
From announcement to clean traffic.
Putting a range behind Orbitel Shield is a routing change, not a migration. Your servers, addresses and DNS stay exactly as they are.
- 1
Add your prefixes
Add each IPv4 /24 or IPv6 /48 in the panel. Your RPKI ROA and IRR route objects need to allow our announcement, and we check them with you.
- 2
We announce them
Your prefixes are announced over BGP from our scrubbing network, so traffic for every address in them reaches our edge first.
- 3
Attacks stop at the edge
Every packet is inspected at the edge closest to where it came from. Floods are dropped there, long before they can fill your links.
- 4
Clean traffic reaches you
What passes is delivered to your routers over a GRE or WireGuard tunnel, and replies leave the same way.
Four stages, each doing what it does fastest.
Every packet passes the same pipeline. Hardware drops the obvious at line rate, so the smarter checks behind it only see the traffic that needs a closer look.
Arriving at the edge
2.84 Tbps
- 1
Hardware filters
Drops 2.42 Tbps
Drop and permit rules, unused protocols and malformed packets, at line rate.
- 2
FPGA meters
Drops 371 Gbps
Per-source rate limits and flood meters hold what is left to the rates set for it.
- 3
Stateful inspection
Drops 36.2 Gbps
Handshakes, queries and payloads are checked, so floods dressed up as real traffic still get caught.
- 4
Machine learning
Drops 200 Mbps
Classifiers score every flow that remains, and tighten when an attacker starts probing.
Delivered to you
12.6 Gbps
Guards for the attacks that actually happen.
Each guard watches for one kind of flood, engages when it starts and steps aside when it ends. Any of them can run in observe mode first, counting what it would drop without dropping it.
Reflection and amplification
Answers your servers never asked for are dropped. Seventeen vectors are known out of the box, from DNS, NTP and memcached to CLDAP and SSDP, and your own can be added.
SYN floods
Once a flood starts, opening SYNs from sources with no connection are held back, while real clients that retry still get through.
ACK and state floods
TCP that belongs to no connection is dropped. The guard learns your servers’ own traffic first, so established sessions keep flowing.
Fragment floods
Fragmented TCP and ICMP are dropped by default. UDP fragments stay open for the games that send them, unless you close them too.
ICMP floods
Pings are rate limited, smurf replies are caught and errors that quote no packet you sent are dropped, while path MTU discovery keeps working.
Crafted packets
Malformed headers, land attacks, martian sources and SYNs shaped like SACK Panic are dropped before anything else has to look at them.
Unused protocols
IP protocols your addresses never receive are dropped outright. GRE, ESP, SCTP and the rest are opened only where you use them.
Pulse waves
Short bursts timed to slip under thresholds are recognized by their shape, and filtering holds through the gaps between them.
Carpet bombing
Floods spread thinly across a whole range are judged together, so no single address has to cross a threshold before filtering starts.
Always on, or on demand.
Filtering is always on by default, so there is no detection delay when an attack starts. If you would rather filter only under attack, on-demand mode is there too.
Always on
Every packet is filtered all the time. Nothing has to be detected first, and nothing changes when an attack starts.
On demand
Traffic passes untouched until it crosses the packet or bit rate you set. Filtering then engages, and holds a little longer each time the same attack comes back.
At a glance.
- Prefix sizes
- IPv4 /24 and IPv6 /48. Larger blocks are added one /24 or /48 at a time.
- Routing records
- An RPKI ROA and IRR route object that allow our announcement
- Mitigation
- Always on by default, or on demand above thresholds you set
- Protocols
- TCP, UDP and ICMP, plus GRE, ESP, AH, SCTP and others where you need them
- Protected addresses
- Every address in your prefixes, with no per-IP pricing
- Billing
- A flat monthly price. Attack traffic is never billed.
- Setup
- Done with our team, usually the same day
Questions, answered.
Can’t find what you need? Talk to an engineer.
Which prefixes can you protect?
Any IPv4 /24 or IPv6 /48 you’re allowed to use. Larger blocks are added one /24 or /48 at a time. Other networks don’t accept anything longer, so a smaller range is protected as part of the /24 or /48 that holds it. Private and reserved ranges can’t be announced.
What do I need before you announce my prefix?
Other networks only accept our announcement if your routing records allow it, so your RPKI ROA and IRR route objects need to cover it. Our team goes through them with you before any production traffic moves.
Do I need to change my servers or DNS?
No. Your addresses and DNS stay exactly as they are. The only change on your side is the tunnel that brings clean traffic in, and the panel writes its configuration for you.
How fast does filtering start?
In always-on mode it never stops, so the first packet of an attack is filtered like every other. In on-demand mode, filtering engages in under a second once traffic crosses your threshold.
Is attack traffic billed?
No. Plans are a flat monthly price for clean traffic. Attacks are absorbed at our edge at no extra cost, however big they get or long they last.
What happens if I remove a prefix?
We stop announcing and filtering it, and its traffic goes back to your normal transit within a few seconds.