01Platform

Why PacketGuard

PacketGuard protects whatever runs on your network: websites, APIs, game and voice servers, and any other TCP or UDP service. Its dedicated filters know how each supported protocol connects, from TCP services to popular games and other widely used applications, so attack traffic is dropped and real users get through.

In-house filtering engine

We develop and maintain the packet filter ourselves, on XDP and eBPF. When a new attack method turns up, we change the filter directly instead of waiting on a vendor.
Game server specialists

Dedicated filters for Minecraft Bedrock, Rust, Counter-Strike 1.6 and 2, DayZ, FiveM, nanos world, TeamSpeak and Unreal Engine 5. They check each game's handshake and answer server-browser queries at the edge, so your servers stay reachable during an attack.
On-premise, on your IPs

PacketGuard is licensed software that runs on your own hardware, inline in front of the servers it protects. Nothing is tunnelled or rerouted through us. Use it on its own, or as a second layer behind the upstream scrubbing you already have.
Real-time analytics

One central control panel and Grafana dashboards for all your locations, so you see your whole network in one place: live traffic, attack history, drop counts per filter and packet samples.
Always on, fully automatic

Filters and limits apply from the first packet, not only once an attack has been detected. Attacks are detected and classified automatically. You get an alert when one starts and a report when it ends.
No noticeable latency

Packets are filtered in the network driver, before the Linux network stack, so the delay it adds is measured in microseconds. Players won't notice it.

02Filters

Game server filters

Most games use their own UDP protocol. A generic filter either blocks it or lets everything through, floods included. PacketGuard knows how each supported game connects, so a spoofed flood can't pass itself off as players.

RakNet

Minecraft Bedrock · Rust

Handshake validation for RakNet's connection sequence. Fake join floods are dropped before they reach the server, and clients that do get in have a per-player rate limit.

Counter-Strike 2

CS2 dedicated servers

Join validation for Counter-Strike 2 servers. Fake connection attempts are dropped at the edge, so only real players reach your server. Server-browser queries are answered from the query cache.

Counter-Strike 1.6

GoldSrc · Half-Life engine

Connection validation for the GoldSrc handshake. Only clients that open a real connection reach your game server, and reflected response packets are dropped.

A2S query cache

GoldSrc · Source 1/2 · Unity · UE4 · more

Server-browser queries are answered from a cache on the node, refreshed every few seconds and protected by a challenge cookie. Works for everything from Half-Life and the Counter-Strike family to Rust, Valheim, ARK and Quake Live.

Steam query port

Rust · nanos world · separate query ports

For a port that carries nothing but server queries. Valid queries are answered from the cache and everything else is dropped, reflection traffic included.

DayZ

DayZ standalone

Join validation and join-rate limits that absorb fake connection floods without locking real players out of the queue.

FiveM

FiveM · CitizenFX

Join validation for FiveM servers. Only clients that complete a real connection get through, so spoofed join floods never reach your server.

nanos world

nanos world · game port

Join validation for nanos world servers. Spoofed connection floods stop at the edge while real players connect as usual. Pair it with the Steam query port filter on the server's query port.

TeamSpeak 3

Voice servers

New clients have to answer a challenge from the node before they reach the voice server, so spoofed connection floods stop at the edge.

Unreal Engine 5

Palworld · UE5 dedicated servers

Handshake validation for UE5 dedicated servers. Spoofed sources never get a session.

Your game next

Custom filters

Running something we don't list? The generic filters protect it from day one, and because the engine is ours, we can write a dedicated filter for your protocol on request.

Beyond per-game filters

These filters work at the protocol level, so they cover anything you run, game or not. They are stateful by default, and when the node sees both directions of a connection they also check the server's replies.

Stateful filtering: Every flow is tracked, tens of millions at a time per node. Packets that don't belong to a known, validated session are dropped before they reach your server.
TCP SYNPROXY: The node completes the TCP handshake itself using SYN cookies and only hands established, legitimate connections to your backend, so SYN floods never touch it.
Symmetrical filters: When both directions of a connection pass the node, filters use the server's replies to confirm a session is genuine. Spoofed sources that can't complete the exchange are dropped.
Generic UDP filter: For services we don't have a dedicated filter for. It only lets through sources your server actually talks to, so unknown games and applications still get flood protection.
GEO and ASN filtering: Block or allow traffic by country, and block whole networks by ASN, per IP or per port. Your customers can manage their own lists from the portal.
Reflection and amplification: Floods reflected off open DNS, NTP, memcached and similar servers are recognized by their source port and dropped. Each port can also be held to the packet sizes its game really uses.
Always-on limits: Per-connection limits and per-IP ceilings apply all the time, so a flood is capped from its first packet instead of after detection.
Traffic from scrubbing tunnels: If your scrubbing provider delivers cleaned traffic over a GRE tunnel that ends on the node, PacketGuard unpacks it and runs every filter on the packets inside.

We keep filter internals private on purpose. Attackers read marketing pages too.

03Control panel

One panel for your whole network

The control panel shows live traffic, attack history and per-IP protection settings for every server you protect, across all your locations. Grafana dashboards are included for real-time stats.

P. PacketGuard A

Attack Timeline › 203.0.113.25

Attack on 203.0.113.25

✓ Ended GAME_FILTER SYN_FILTER A2S_CACHE on AMS-Edge-01 · 203.0.113.0/24 ⤓ Download PCAP

203.0.113.25 1m 10s · 12:49:43 → 12:50:53

Duration1m 10s12:49:43 → 12:50:53

Peak PPS41,281packets / second

Peak bandwidth393.93 Mbpsdropped at edge

Total volume1.41 GB1,271,043 packets

Dropped Traffic During Attack Drop PPS Drop Mbps

Attack timeline

Every attack is recorded with start, end, peak traffic and target. Click into any incident for the full breakdown.

Leak analysis

Every attack page shows whether anything got past the filters. One click analyzes the attack's capture and explains what got through and which setting to change.

Packet samples and captures

Every attack is captured automatically, in both directions. Browse sampled packets by source, port or action, or download the full pcap.

Per-IP rules and presets

Set protection per IP, or apply a preset across many. Changes reach every node in seconds.

Customer portal

Give your customers their own portal: their prefixes, their rules and presets, and their own GEO and ASN lists.

Grafana and real-time stats

Live dashboards for traffic, drops and filter activity at every location. Watch an attack being mitigated as it happens.

Alerts

Email, Slack and webhook notifications when an attack starts and when it ends.

Audit log and SSO

The audit log shows every change your team makes in the panel: who changed what, and when. Sign in with single sign-on and two-factor authentication.

04Optional: BGP mitigation

When an attack is bigger than your uplink

PacketGuard filters on your own network, so it can only clean traffic that fits through your uplink. For floods bigger than that there is an optional BGP module. The node talks BGP to your own routers, not to your transit providers. When an attack crosses a limit you set, your routers carry out the policy you chose: null-route the attacked address, or move its /24 to a scrubbing provider or another upstream.

You don't need it for filtering. Everything else on this page works without it.

Networks without upstream protection: If you buy plain transit, for example a single 100G uplink from Cogent, nothing upstream absorbs a flood that fills the link. The BGP module gives you a way to act automatically when that happens.
A fallback behind your scrubbing provider: If you already use GSL, GCore, Cloudflare or a similar provider, PacketGuard filters whatever they pass on. The BGP module covers the attack they can't absorb or filter well enough.

Null-route one address

When one IP draws more traffic than your uplink can carry, your routers announce it upstream as a blackhole (RTBH). That address goes offline and the rest of the network stays up.

Move a /24 to another upstream

Or send the whole /24 through your scrubbing provider or another upstream while the attack lasts, and move it back once it is over.

A policy per prefix

You decide per prefix what happens, from what attack size and for how long.

Protected addresses

Addresses you mark as protected are never dropped, whatever the attack.

Test mode and kill switch

Test mode shows what would have happened before you go live. One switch stops every action.

Router configuration included

For Arista EOS the panel generates the router configuration for you. Every action is logged.

05Licensing

Runs on your network, not ours

PacketGuard is on-premise software, licensed to hosting providers, game studios and ISPs. You run the nodes. We provide the engine, the panel and the people behind them.

Runs on standard Linux servers. No special hardware needed, though a NIC with native XDP support gets you line-rate filtering.
Works on its own or behind an upstream scrubbing provider, GRE tunnels included.
Optional BGP integration with your routers for attacks bigger than your uplink.
Updates apply under live traffic, without downtime or dropped connections.
Prometheus metrics and ready-made Grafana dashboards included.
REST API for everything the panel can do.
Onboarding and filter tuning together with our engineers, not a ticket queue.
New filters and fixes ship fast, because the whole engine is ours.

Ask about licensing

DDoS protection built for hosting providers.