Network Protection at Line Speed
Defend your UDP and TCP infrastructure from the most devastating volumetric floods, SYN floods, and UDP amplification attacks. Our edge filters drop malicious packets before they ever reach your application.
Network Attack Vectors We Neutralize
Every second, billions of malicious packets target infrastructure worldwide. Gateway Sentry identifies and drops these attacks at line rate, protecting your servers from the full spectrum of Layer 4 threats.
SYN and ACK Flood Mitigation
SYN Flood
Overwhelms servers by sending massive volumes of TCP SYN packets without completing the three-way handshake, exhausting connection tables and memory. Our edge filters detect and drop SYN floods before they consume resources.
Critical ThreatUDP Flood
Saturates bandwidth with a torrent of UDP datagrams targeting random ports, forcing the server to process and respond with ICMP unreachable messages. Our edge absorbs and filters the flood without impacting legitimate traffic.
Critical ThreatACK Flood
Sends spoofed TCP ACK packets at high volume, bypassing stateless firewalls and forcing servers to waste cycles looking up non-existent connections. Our stateful packet inspection identifies and drops illegitimate ACKs instantly.
Critical ThreatReflection and Amplification DDoS
DNS Amplification
Exploits open DNS resolvers by sending small queries with a spoofed source IP, generating responses up to 70x larger directed at the victim. Our edge nodes absorb amplified traffic and validate source authenticity in real time.
AmplificationNTP Reflection
Abuses the NTP monlist command to amplify traffic by up to 556x, flooding victims with massive UDP responses from legitimate NTP servers. Gateway Sentry fingerprints and filters reflected NTP traffic at the network edge.
AmplificationSSDP Amplification
Leverages Universal Plug and Play devices to generate amplified responses exceeding 30x the original request size. Our protocol-aware filtering identifies SSDP reflection patterns and drops them before they reach your infrastructure.
AmplificationHow We Stop Network Attacks
From packet ingestion to clean delivery, every step is optimized for speed. Our pipeline processes millions of packets per second with zero perceptible latency added to legitimate connections.
Edge Ingestion
All inbound traffic is received at our global edge network, distributed across multiple points of presence. Anycast DDoS protection ensures packets arrive at the nearest scrubbing center, minimizing latency before analysis even begins.
Edge-Level Filtering
Packets are inspected by our edge filters at the earliest possible stage. Malicious traffic is identified and dropped before it ever reaches your application, achieving line-rate filtering with zero impact on performance.
Clean Forwarding
Verified legitimate traffic is forwarded to your origin server through our optimized tunneling infrastructure. GRE and direct peering options ensure minimal additional latency while maintaining full packet integrity and connection state.
Edge-Level Defense
Traditional DDoS mitigation adds latency and consumes resources even for packets that will ultimately be dropped. Gateway Sentry takes a different approach.
Gateway Sentry deploys edge filters at the earliest possible interception point. Malicious traffic is matched and dropped before your server allocates any resources to the connection.
L3/L4 protection stops packet-level floods, while L7 web application DDoS protection handles request-level attacks; run both for full L3 to L7 coverage. Volumetric scrubbing relies on our anycast edge network and PoP locations, and latency-sensitive workloads benefit from UDP DDoS protection for game servers.
// Kernel-level packet filter (pseudocode)
function filter_packet(packet):
// Parse Ethernet and IP headers
ethernet = parse_ethernet(packet)
ip = parse_ip(packet)
// Check blocked IP map
if blocked_ips.contains(ip.source):
return DROP // Kernel-level drop
// SYN flood detection
if ip.protocol == TCP:
tcp = parse_tcp(packet)
if tcp.is_syn and not tcp.is_ack:
update_syn_counter(ip.source)
if exceeds_threshold(ip.source):
return DROP
return PASS // Forward clean trafficComplete Protocol Protection
Every major transport and network protocol is covered. Whether you run game servers, VoIP infrastructure, VPNs, or custom UDP applications, Gateway Sentry has you covered.
TCP Protection
Comprehensive protection for all TCP-based services. Flood attacks and connection abuse are detected and stopped at the edge, while legitimate connections pass through seamlessly to your origin.
Always-OnUDP Protection
Full protection for UDP-based services including gaming, VoIP, and custom applications. Volumetric floods are absorbed at the edge while legitimate traffic flows through uninterrupted.
Game-ReadyGRE Tunnel Security
Secure GRE tunnel endpoints with deep packet inspection of encapsulated traffic. Prevent tunnel abuse, detect encapsulation-based evasion techniques, and ensure only authorized tunnel traffic passes through to your network infrastructure.
Tunnel-AwareICMP Filtering
Intelligent ICMP management that blocks ping floods and ICMP abuse while preserving essential network diagnostics. Your infrastructure stays protected without sacrificing visibility.
Flood DefenseFrequently Asked Questions
What is L3/L4 (network layer) DDoS protection?
Which network DDoS attacks does Gateway Sentry stop?
How does Gateway Sentry protect against UDP floods?
How does anycast routing help mitigate volumetric attacks?
What is reflection and amplification, and how is it filtered?
Protect Your Infrastructure
Deploy network DDoS protection in minutes. No hardware changes, no traffic rerouting delays. Just activate Gateway Sentry and let our edge filters handle the rest.