SentiGate stands between the internet and your infrastructure. DDoS floods get dropped at the nearest of our 11 scrubbing sites, and your real customers, players and API clients keep getting through as usual.
Animated illustration: red attack packets hit a yellow gate and disappear, while white packets from real users pass through and line up toward your server.
SentiGate filters SYN floods, UDP floods, DNS, NTP, memcached, SSDP and CLDAP amplification, ACK and RST floods, ICMP and GRE floods, fragmentation attacks, carpet bombing, TCP state exhaustion, TLS handshake floods, HTTP floods, HTTP/2 Rapid Reset, Slowloris, credential stuffing, scraper bots and SQL injection.
Pick the one that matches how traffic reaches you: through a domain name, or through IP addresses you own. Plenty of teams start with one and add the other later.
Point your domain at SentiGate and we take the attacks for you. Network floods are absorbed at our edge, and HTTP floods, bots and exploit attempts are filtered out before they reach your code.
We announce your prefixes from our network, so traffic to them lands at the closest scrubbing site. After cleaning at layers 3 to 5 it goes back to your routers over GRE or a direct link.
There is no hardware to install and no agent to run on your servers. You point traffic at us once, and from then on the filtering happens on our network.
For a website you change one DNS record. For a network we announce your prefixes from our edge over BGP.
Anycast sends every packet to the closest of our 11 scrubbing sites. Floods get dropped there, near where they started, instead of piling up at your door.
Real traffic reaches you over HTTPS, a GRE tunnel or a direct cross-connect. You can see what got dropped and why.
Together they have more than 7 Tbps of filtering capacity. Click anywhere on the map to launch an attack and see which gate takes it, or pick a gate to read why we put it there.
Interactive world map with SentiGate's 11 gates. Clicking a point simulates an attack from there and shows which gate absorbs it.
The background attacks are simulated, and yours go wherever you click.
Any DDoS provider looks fine on a quiet day. Here is what we think matters during a real attack.
If an attack changes in a way the filters don’t expect, you talk to a network engineer who can see your traffic and adjust the filters right away. The operations team works around the clock, and the engineer who answers has the access to make those changes.
Anycast splits an attack between the gates closest to its sources. A botnet in Asia runs into Singapore and Hong Kong and never gets close to your servers in Virginia.
With gates in Panama City and São Paulo, Latin American traffic gets cleaned in the region instead of taking a round trip through the United States.
For every blocked request you can see which rule blocked it and why. If a rule is too strict for your traffic, you can change it yourself or ask us to.
It can be AWS, a bare-metal rack, a shared host or your own data center. If it has an IP address, we can stand in front of it, and you don’t need to install anything.
Write to our NOC with the domain or IP range that’s being hit. An engineer will reply with the fastest way to route it through SentiGate.