Zero attack packets reach your server.
Websites, DNS, email, remote access, game servers or your entire network. We filter on an anycast network with nodes in Argentina, Chile, Brazil, Miami and Dallas, with a dedicated profile for each service: attacks are dropped close to where they originate, and only legitimate traffic reaches you.
A service by inetHost · own network AS266777
Argentina, Chile, Brazil, Miami and Dallas, all announcing your IPs at once.
We measure every IP at the network edge, second by second.
Filters run in XDP, before the packet ever touches the OS.
We announce and divert with our own ASN, without waiting on a third party.
Every service gets its own filter.
You don't stop an attack on a website the same way you stop one on DNS or SSH. Every port we protect carries the profile of whatever runs on it: it knows how that protocol talks, and lets through only traffic that talks that way.
Web and APIs
Websites, online stores, control panels and APIs. Down on the NIC we stop volumetric floods; higher up, we inspect request by request, which is where an attack on a website really does damage.
Passes
- Browsers and clients that complete the connection
- Your CDN in front: if you use Cloudflare, its ranges pass
- Large downloads and uploads, uninterrupted
Dropped
- SYN floods and half-open connections
- Floods of valid requests: a requests-per-second cap per source
- Slowloris and connections that never finish
- Unusual methods and bots
For HTTPS, to inspect each request we terminate TLS at the node with your certificate. Without a certificate, we filter per connection and the content passes through encrypted.
DNS
Your authoritative server or your resolvers. Every packet is checked against the DNS format: anything that isn't a well-formed query doesn't get through.
Passes
- Well-formed, single-question queries
- Real resolvers, even under attack: we ask them to retry over TCP, and those that do, pass
- Your secondaries and known resolvers, on a list
Dropped
- Responses nobody asked for (reflection aimed at you)
- ANY queries and malformed packets
- Malformed names
- More than 1,000 queries per second from a single source
Remote access
Manage your servers without leaving the port open to anyone. To reach it, you have to speak the protocol from the very first packet.
Passes
- Clients that actually speak SSH or RDP
- Your session, even under attack: once you're in, it flows
- Your static IPs, on an allowlist
Dropped
- Junk TCP: without the protocol's signature, it never touches the port
- More than 10 new connections per second from a single source on SSH, more than 4 on RDP
- The rest of the world, if you close the port and leave only your list
Email and custom TCP
Email, databases, your own APIs and any TCP service without a dedicated profile. We limit connection setup, not packets: whatever happens inside a connection flows freely.
Passes
- Fully established connections, with traffic flowing freely inside
- Large transfers, uninterrupted
- Clients that retry, even under attack
Dropped
- Spoofed SYN: we answer on your behalf and only clients that complete the connection pass
- More than 20 new connections per second from a single source
- With connection tracking: any ACK, RST or FIN that doesn't belong to an open connection
Custom UDP
Voice, VPN, streaming and your application's own protocols. It starts with a per-source cap; tell us what your protocol looks like and we'll filter on its shape too.
Passes
- Your users' traffic, with a per-source cap
- Packets shaped like your protocol: the length and leading bytes you specify
Dropped
- Empty UDP and reflection from DNS, NTP, memcached and the like
- More than 5,000 packets per second from a single source
- Anything without your protocol's length or signature, once we load it
Games
Per-game profiles that validate the player's join, not just the volume. A flood shaped like the game isn't enough: it has to complete the join.
Passes
- Players who complete the join to the server
- Players already in game, even while the attack continues
- Server-list queries, rate-capped
Dropped
- Anything that isn't game traffic on the game port
- Fake joins that never complete the handshake
- Status-query floods
ISP subscribers
For subscriber networks: an attack on one subscriber doesn't take everyone else offline, and for the target we close only what's being hit.
Passes
- Subscribers' browsing, video and gaming, as usual
- Responses to whatever the subscriber requested
- With CGNAT: an attack on a shared IP doesn't knock out everyone using it
Dropped
- The attacked IP:port, for as long as the attack lasts, and nothing else
- Reflection and amplification aimed at the block
Don't see your service? It starts on the generic TCP or UDP profile and, based on real traffic, we add your protocol's signature. We also detect on our own what runs on each port and suggest a profile.
Geo-blocking
Allow traffic only from the countries or regions you care about.
Allowlists and blocklists
By IP, by network and by port. Your IPs always pass.
Per-port rules
Down to the exact port: open, profiled or closed.
Per-connection limits
No single source takes it all: whoever exceeds the limit is cut off.
ICMP control
Ping allowed, rate-limited or blocked, per IP.
API
Rules, lists and attacks, straight from your own system.
Attacks are stopped close to where they start.
Our network is anycast: all five nodes announce your protected IPs at the same time, and the internet routes each packet to the node closest to its source. An attack coming from the United States is dropped in Miami or Dallas; one coming from Brazil, in Brazil. None of it travels to your server, and no single node carries the full load: mitigation is distributed. Try the same attack without anycast.
Argentina
A filter at every POP. Attacks are stopped at the point where they enter the country.
Presence · cross-connect or IXChile
Stops what originates across the Andes and in the South Pacific, before it crosses over.
Presence · cross-connect or IXBrazil
Attacks originating in Brazil are dropped in Brazil and never travel to your server.
Presence · cross-connect or IXMiami
Takes what arrives from the North American East Coast and from Europe, before it heads south.
Presence · cross-connect or IXDallas
Covers the central and western United States, plus what comes in from Asia across the Pacific.
Presence · cross-connect or IXWe're inside every POP.
We have physical presence at each of these locations. If your network is there too, you connect directly to us without going over the internet, and whatever enters at that point is filtered right there.
Detect, divert, filter, deliver.
From the moment an attack starts until only legitimate traffic reaches your server. With always-on protection, traffic already flows through the filter and no diversion is needed.
We see the attack at the edge
We measure each IP's traffic second by second and compare it against that IP's normal baseline.
in secondsWe announce the IP from all 5 nodes
The attacked IP or prefix moves onto the anycast network via BGP: the attack is spread across all of them.
automaticLayers of filters on the NIC
Attack signatures, each service's profile and per-source limits, in XDP.
microsecondsLegitimate traffic reaches you
We hand clean traffic back over our network or through a GRE tunnel to your equipment.
alwaysWhat's never legitimate
Stray fragments, port zero, malformed packets and impossible sources.
Reflection and amplification
Unsolicited responses from DNS, NTP, memcached and the like.
Your service's profile
The filter knows how whatever runs on each port talks, whether it's a website, DNS, SSH or a game: anything that doesn't talk that way doesn't pass.
Per-source and per-connection limits
No single source can take it all: whoever exceeds the limit is cut off; everyone else keeps going.
From a single IP to your entire network.
The same filter in every case: on our network or on an appliance in your own data center. What changes is what comes in through PacketZero and how we hand clean traffic back to you. Tell us what you have and we'll send you a quote.
Protected IP
Your server on our IPs, which already come in through the anycast network. Nothing to configure on your end.
- One profile per port
- Rules and lists from the dashboard
- Always behind the filter
GRE tunnel + BGP
We announce your prefix from all five nodes and hand clean traffic back to you through a GRE tunnel, wherever you are.
- Your /24 or larger, with your ASN or ours
- One tunnel per edge router
- Automatic or permanent diversion
Cross-connect or IX
If your network is at one of our POPs, you connect via a cross-connect or over the IX and we deliver clean traffic right there, with no tunnel over the internet.
- CABASE, Cirion, Telxius, PIT Chile, PIT Peru, Equinix São Paulo, IX.br, FL-IX, DE-CIX Dallas and DFW-IX
- Traffic coming in that way is filtered too
- For ISPs: subscriber mode, CGNAT-compatible
Resell
Protect your infrastructure and each of your customers, each with their own access.
- A portal per customer: their IPs, their attacks, their rules
- API to provision from your own system
- WHMCS module
Always-on
Your traffic goes through the filter all the time. No diversion, no seconds of delay: the attack runs into a filter that's already in place.
On-demand
Your traffic flows directly and we monitor it at the edge. When an attack starts, we divert the IP or prefix to the anycast network within seconds, and when it ends, traffic goes back.
The PacketZero appliance, in your rack.
We install a PacketZero appliance inline with your links, inside your data center. It runs the same filters and profiles as the network and mitigates right there, on site: traffic never leaves your data center to get scrubbed.
- 01Local mitigationEvery attack is stopped on site, with no diversion and no added latency.
- 02Same profiles, same dashboardWeb, DNS, SSH, games, subscribers: whatever runs on the network runs on your appliance, and you see and tune it from the same dashboard.
- 03We operate itMonitoring, updates and filter tuning are handled by our team.
- 04Backed by the networkIf an attack is bigger than your link, we divert it to the anycast network and it still reaches you clean.
See every attack. No black box.
- 01What it wasProtocol, which ports it hit, which ports it came from, and which countries and networks it came from.
- 02How much we stoppedWhat arrived, what we dropped and what we delivered to you, minute by minute.
- 03Your rules, instantlyAdd a port, change a profile, block a country or add an IP to the allowlist, and it takes effect on all five nodes.
- 04A report for every attackTo send to your customer or keep on file.
What people ask us before signing up.
Does it add latency?
The filtering itself adds microseconds. What can change is the path, and that's what anycast is for: traffic enters through the node closest to its source. For your users in Argentina, the filter is in Argentina; for those in Chile or Brazil, it's in their country.
Will my users notice the attack?
The goal is that they won't. Each service's profile lets through anyone who behaves like a real client, whether that's a browser, a resolver, an email client or a player, even while the attack continues. If something legitimate gets blocked, you'll see it in the dashboard and we'll tune it.
Do you protect HTTPS websites?
Yes, in two ways. With your certificate, we terminate TLS at the node and inspect request by request: request floods, slowloris, bots. Without a certificate, we filter per connection and the content stays encrypted all the way to you. If you already have Cloudflare in front, we let its ranges through.
What if my service isn't on the list of profiles?
It starts on the generic TCP or UDP profile, with per-source and per-connection limits. Based on real traffic, we add your protocol's signature so that only traffic with its shape gets through.
Can I have PacketZero in my own data center?
Yes. We install the PacketZero appliance inline with your links and it mitigates right there, with the same profiles and the same dashboard as the network. We operate it, and if an attack exceeds your link, we divert it to the anycast network.
Can I resell it to my customers?
Yes. Each of your customers gets their own portal access, where they see only their IPs, their attacks and their rules. There's an API to provision them from your own system, and a WHMCS module.
What do I need to change on my server?
On one of our IPs, nothing. For your own prefix, we set up the BGP announcement and delivery over a GRE tunnel or, if you're at one of our POPs, over a cross-connect or the IX; we'll walk you through the configuration.
What happens with a very large attack?
It's spread across all five nodes, and each one stops its share. The largest volumes are stopped at the network edge before they even reach the filters. The dashboard shows you how much came in and where it was stopped.
Always behind the filter, or only during an attack?
Both. Always-on: your traffic goes through the filter all the time, with no diversion. On-demand: we detect the attack and divert the IP within seconds. We'll recommend one based on your service.
How do I sign up?
Fill out the form below with what you want to protect and we'll send you a quote. Once you're onboarded, you get access to the dashboard.
Tell us what you want to protect.
We use this information to put together the proposal: what comes in through PacketZero, with which profile, and how we hand the traffic back to you. We'll reply by email.