Operator-grade protection
DDoS protection for carriers and ISPs
We protect operator networks with full BGP integration, custom security policies and direct engineer support. Your customers will not notice the attack.
Our own AS202520 network and scrubbing in Poland.
AS202520
Our own network and scrubbing in Poland
9 Tbps
Largest attack mitigated
95/5
Billing for the bandwidth you actually use
24/7
NOC, monitoring and SLA reporting
Built for operator networks
We know what running a network looks like because we run one ourselves. SkyPass protection integrates with your network, not the other way around.
BGP integration
We establish BGP sessions and take over announcing your prefixes for the duration of an attack. Clean traffic returns to you via a tunnel or a direct link.
Bandwidth from 1 to 100 Gbps
Scale protection as your network grows. We bill on the 95/5 model, so you pay for the bandwidth you actually use.
Filtering with no blackholing
Your customers stay online even during an attack. We drop only malicious traffic while the rest arrives untouched.
Custom security policies
We tailor filtering profiles to your services. You can run separate policies for different prefixes and customer groups.
Monitoring and SLA reporting
Our NOC keeps watch 24/7 while you get full visibility into traffic and incidents in the client panel, along with SLA reports.
Dedicated technical contact
You talk to an engineer who knows your network. No call centre and no explaining everything from scratch with every ticket.
What we protect
Everything your subscribers' internet depends on
An attack on an operator rarely targets a single server. It hits the links, whole address pools and the devices all subscriber traffic passes through. SkyGuard protects each of them.
Transit links
The SkyPass network takes the attack traffic before it reaches your links. You do not need to overprovision bandwidth just in case.
Whole prefixes and subscriber pools
We protect the entire address space announced through our network, even when an attack is spread across many addresses at once (carpet bombing).
NAT gateways (CGNAT) and BRAS
The devices every subscriber goes through. We have technology designed specifically so that attacks, TCP-ACK floods included, do not overload them.
DNS and subscriber services
DNS resolvers and the other services your customers use, even when an attack targets port 53.
Online gaming and VPNs
Real-time traffic, VPNs and asymmetric routing keep working during filtering. We tune the profiles to your network's traffic.
Service continuity
No blackholing: we drop only malicious traffic and your subscribers stay online, even during attacks lasting many hours.
NAT gateways and BRAS
A TCP-ACK flood will not overload your NAT gateways
NAT gateways (CGNAT) and BRAS handle the traffic of all subscribers at once. A flood of TCP-ACK packets can overload them before the link fills up, and then every customer loses internet at the same time. That is why we have technology designed specifically for these devices and for TCP-ACK attacks.
Stateful filtering in front of the NAT
Our stateful firewall tracks the state of TCP connections. ACK packets that do not belong to any established session are dropped in scrubbing before they reach your devices.
NAT tables and CPU stay normal
The NAT gateway and BRAS receive only the traffic they are meant to handle, so an attack does not fill session tables or exhaust the CPU.
Subscriber traffic gets through
Replies to connections opened by subscribers arrive unhindered. We filter the attack, not your customers.
Separate policies for CGNAT pools
Address pools behind NAT gateways can have their own filtering profiles, independent of your other prefixes.
With SkyGuard, ACK packets without an established session are dropped in scrubbing. The NAT gateway receives only subscriber traffic and runs normally.
What we protect against
The attacks operators face
We filter attacks from the network layer to the application layer (L3/L4/L7) in scrubbing centres in Warsaw and Wrocław.
Volumetric attacks
Floods of UDP, ICMP and IP fragments meant to saturate your links. The largest attack mitigated on our infrastructure was 9 Tbps.
Amplification and reflection
Amplified replies reflected off open services on the internet, such as DNS or NTP.
SYN, ACK and other TCP floods
Floods of TCP packets, SYN and ACK floods included, filtered by the stateful firewall.
Carpet bombing
An attack spread across a whole subnet so that no single address looks suspicious.
Application-layer attacks (L7)
Traffic posing as real users, aimed at services and applications.
Multi-vector and long-running attacks
Several techniques at once and attacks lasting hours, even at terabit scale.
Ransom DDoS (RDDoS)
Blackmail of the “pay or we keep attacking” kind. With SkyGuard protection you do not have to pay.
DNS attacks
Query floods and probes on port 53 aimed at the operator's resolvers.
From practice
An operator under a ransom DDoS attack. Ransom paid: PLN 0
A fibre internet provider's network went down on a Friday afternoon and the extortionist demanded a ransom. By day three the operator's traffic was flowing through SkyGuard, and for the following weeks the daily attacks ended in our scrubbing.
5.5 Tbps
Attack peak
The attacks went on for hours without a break.
50 days
Of daily attacks
An attack every day until the extortionist gave up.
Day 3
Network back online
Traffic through SkyGuard with no prior contract or link.
PLN 0
Ransom paid
The operator never replied to the extortionist.
Starting with no contract and no link
We announced the operator's prefixes from AS202520, and a GRE tunnel brought the network back over the weekend with no physical installation. A few days later an L2 VLAN replaced it.
No blackholing of subscribers
The attack ended in scrubbing in Warsaw and Wrocław, and the operator's customers stayed online.
Tuned for operator traffic
Online gaming, VPNs and asymmetric routing work after joint tuning with the operator.
Our network in Poland
Two PoPs connected by redundant routes
Our main point of presence is in Warsaw, with a satellite PoP in Wrocław. Three independent routes connect them, so a single link failure does not stop traffic.
- Warsaw, our main PoP
- Wrocław, satellite PoP
- Redundant links between PoPs
- Cities with partner transit
Transit via partner operators
Click a city on the map or pick one from the list to see the details.
How onboarding works
You're three simple steps away from full network protection.
- 01
Network analysis
We learn your topology, prefixes and requirements, then agree on the protection architecture and the way we connect.
- 02
Tests and configuration
We establish BGP sessions and tunnels, then test traffic switchover with no impact on production.
- 03
Production and constant watch
We enable protection and monitor traffic 24/7. We respond to incidents and help you keep optimising.
Contact
Let's talk about protecting your network
Tell us about your topology and requirements. We will prepare a protection proposal matched to the scale of your network.
After you send the form, we come back to you with questions about the details or a proposal for the next step: a call, tests or an offer.