How to choose a service tier that is suitable for your site or service

Below you will find an overview which we hope will help you decide on an appropriate service tier for your site / service. Thank you for choosing X4B for your protection needs.

What service tier is right for me?

This list is non-exhaustive and does not consider your specific situation. We do hope however these examples will help you in making your choice.

Budget:

• I'm running a hobby site and I need basic protection; or
• I'm not likely to receive complex attacks; or
• I need the lowest price possible, nothing else matters

Standard Anycast:

• This is our most popular product and suitable and recommended for most users
• Includes Anycast based redundancy through Points of Presences (PoPs) in Europe and the United States

Premium Anycast:

• Me and/or my users are based in Asia/South America; or
• I need low latency to Asia and all citizens of the world; or
• I need the additional Layer 7 Capacity; or
• I need the best you can offer

Guaranteed vs Burstable protection

Guaranteed protection refers to the threshold of attack we can reasonably guarantee we can mitigate in a PoP. This threshold is in both Bandwidth peak volume (Gbps) or Packets Per Second (PPS). We do not limit the time in which customers may be under attack within this threshold.

Burstable protection refers to the threshold of attack we can usually cover and will cover for a reasonable period of time. With the guaranteed thresholds we attempt to reasonably estimate likely worst case scenarios. This may not apply to every attack in this case the burstable limit is applied. As per the name due to the cost of bandwidth involved in mitigating large attacks it may not be possible for us to mitigate attacks above the guaranteed protection thresholds indefinitely.

These are per-service protection thresholds. Aggregate network capacity is not a protection entitlement for an individual service. See the attack mitigation FAQ for information about protection limits and nullrouting.

Technical Capability Overview

Confirm current tier limits and availability against your service details before purchase.

Most system features are offered for all tiers (where applicable) however some fair use limits differ between service tiers.

What is your mitigation capacity?

Mitigation capacity depends on both the available network resources and the attack being handled. We distinguish a conservative guaranteed threshold from a burstable threshold that can be achieved under more favourable conditions. Use the thresholds and terms for your selected service when planning protection.

Aggregate network capacity combines resources across locations and filtering stages. The traffic that one service can handle also depends on where the attack arrives and which mitigation stages can process it.

How we mitigate?

We take a layered approach to DDoS mitigation:

• X4B filtering and analysis handles attacks requiring more detailed traffic inspection.
• Network-level filtering at the point of presence (PoP) provides filtering we can control before traffic reaches the backend connection. Additional filtering clusters supply capacity beyond our own detailed inspection systems.
• Transit-level filtering, where available, removes UDP amplification traffic upstream, reducing the traffic that reaches our local filtering systems and links.

These stages provide different capabilities. An amplification attack that can be filtered upstream places less load on local resources than an equally large attack requiring detailed inspection. The reduction depends on the attack and the filtering available on its route.

So what can we mitigate?

Bandwidth, packet rate and attack complexity all matter. An attack spread across multiple locations can use more of the network's combined resources; an attack concentrated on one location depends on the capacity available there.

Attackers can also change methods during an attack, replacing easily filtered traffic with traffic that costs more to inspect. Mitigation capability is harder to summarize than bandwidth alone. Our guaranteed threshold represents a conservative level at which an attack may begin to cause trouble; capacity describes the upper level that can reasonably be mitigated automatically under suitable conditions. This is why we publish service thresholds separately from aggregate capacity.

Capacity and bandwidth costs vary by region. Asia and South America have historically had higher bandwidth costs and lower available capacity than Europe and the US. We have performed extensive tuning to maximise our capacity in these regions.