ISO 27001
SOC 2 Type II
BSI C5
Internet service provider · Network DDoS
Network DDoS Protection. Your network stays online, whatever comes at it.
Keeps critical services online when attacks hit, without sacrificing legitimate traffic. Every mitigation is visible and explainable.
- Stops floods, exhaustion and multi-vector attacks
- Mitigation in 0–3 s
- Learns normal behavior
- Every mitigation explained
Trusted byFrom mid-market to enterprise
Network DDoS Protection. What it is and what it does.
Network DDoS Protection routes your traffic into the Link11 network, filters volumetric and protocol attacks at layers 3 and 4 and returns clean traffic to your routers — always-on, on-demand or hybrid, with a baseline that learns your normal behavior.
Stop volumetric DDoS attacks upstream of your infrastructure
Learn normal behavior instead of tuning thresholds
Read up on every mitigation decision
Attackers scale. Your protection should too.
322 millionPackets per second: the maximum packet rate in the first half of 2026.
1 millionAttacks mitigated since we launched.
705 TBCumulative attack volume in the first half of 2026 (a 61% increase).
- 24/7 SupportSecurity threats don’t wait for business hours, and neither do we. Our specialists are available around the clock to help you when needed.
- GDPR-compliantLink11’s European location ensures your content remains compliant with strict GDPR regulations and EU data protection laws.
- Fully managed serviceOur fully managed solution, maintained by security experts around the clock, ensures your protection is always up to date, 24/7, 365 days a year.
Intelligent defense against evolving attacks. Before your uplink fills up.
Attacks are routine. Outages shouldn’t be.
Protection you can verifyHigh-speed network DDoS protection with transparent mitigation across layers 3 and 4.
Know what was blocked, why it was blocked, and what remains online.
Resilience you can maintainProtection adapts continuously to live traffic, applying only the mitigations that are actually needed.
Fewer false positives, and no constant manual tuning.
Visibility you can act onEvery mitigation is visible, explainable and under your control.
Reporting becomes clearer, and your team stays in control when pressure is highest.
Protected all the time, or only when it counts. You decide how your network runs it.
In May 2019, the Italian internet service provider Genesys Informatica faced a very large DDoS attack.
Link11 infrastructure protection was deployed within a few hours, and Genesys fended off one of the largest DDoS attacks in Italian history.
Case study: Genesys InformaticaIT service provider NETHINKS needed DDoS protection that handles attacks of several 100 Gbit/s, to complement its existing solutions.
After a proof of concept, NETHINKS chose Link11, with bandwidth beyond 100 Gbit/s and fully automated detection and mitigation.
Case study: NETHINKSGLASFASER RUHR’s fiber infrastructure serves businesses and municipalities and requires the highest level of stability.
Traffic runs continuously through Link11 protection with fully automated detection and mitigation, as baseline protection for its business customers.
Case study: GLASFASER RUHR
Business as usual, even under the heaviest attacks.
Click through what the protection does, and see it in the interface.
From connection to clean traffic. The defense learns what normal looks like for you.
Legitimate traffic, before the checkAttack, stoppedLegitimate traffic, delivered cleanLearns from normal traffic
Before you connect. The technical details.
- Connection: BGP from a /24 IPv4 or /48 IPv6, via GRE or Layer 2
- Operating model: Always-on, on-demand, hybrid
- Protection layer: Layers 3 and 4, IPv4 and IPv6
- Evidence: Event log, attack report, history
- Requirement
- At least a /24 IPv4 and/or a /48 IPv6 network for BGP redirection.
- Connection
- A GRE or Layer 2 connection between the Link11 scrubbing centers and your infrastructure.
- Return path
- Responses from your network go back to the requester through the same tunnel (synchronous) or bypass Link11 (asynchronous).
- Hot standby
- BGP redirection works as hot standby: in normal operation your traffic flows as before, during an attack through the scrubbing center.
- Always-on
- Traffic runs permanently through the scrubbing center. Protection without a switch-over moment, recommended for applications.
- On-demand
- Flow data is monitored; during an attack a BGP announcement triggers the rerouting — manually by your team or automatically by Link11.
- Hybrid
- Both combined, decided per service.
- Layer 7
- Layer 7 attacks such as HTTP floods, Slowloris or zero-day exploits are covered by Web DDoS Protection, part of Link11 WAAP.
- Timing
- On-demand needs a few minutes until rerouting. Inside scrubbing, mitigation takes 0–3 seconds.
Works alongside Network DDoS ProtectionWeb DDoS ProtectionNetFlow DDoS DetectorClean TransitAll products
Protection in place within a few hours.
Questions before you decide. Answered directly.
How does this differ from Web DDoS Protection?
Network DDoS Protection protects networks, prefixes and autonomous systems at layers 3 and 4 — volumetric and protocol-based attacks, connected via BGP. Web DDoS Protection is part of the WAAP platform and protects web applications against layer 7 attacks such as HTTP floods.
What do I need to connect?
At least a /24 IPv4 and/or a /48 IPv6 network for BGP diversion, and a GRE or Layer 2 connection between Link11 and your infrastructure.
How quickly does on-demand kick in?
With on-demand, diversion via BGP announcement takes a few minutes. Always-on is recommended for applications, on-demand for services such as mail or database servers.
What evidence do we get after an attack?
Real-time transparency through detailed logs, per-IP statistics and reason codes. Every mitigation decision is explainable, with a searchable event log, attack history and top-source breakdown.
What does Network DDoS Protection cost?
Network DDoS Protection has custom pricing: you receive an individual quote. The NetFlow DDoS Detector is charged separately.
Who runs and supports the protection?
Link11 takes full responsibility for managing and maintaining your service, proactively monitoring performance and responding before issues impact your business. Our specialists are available around the clock, 24/7, 365 days a year.
Let’s talk
Your business stays online. We’ll show you how.