Yesterday we talked about how the Black Lotus MitigationPro by IntruGuard leverages a custom engineered FPGA to mitigate DDoS attacks at full line rate, without performance impact. Today, we’ll go into further depth.

Simply put, MitigationPro is a hardware based filtering solution that performs much like a network switch, moving traffic from point A to point B, efficiently. Our closest competitors are using x86 based servers using custom engineered software packages. These are therefore, software based solutions.

Let’s take a look at the MitigationPro AMP1004:

If you click on the thumbnail you can expand to a full view of the internal components. The board on the left is the management logic which is a Linux based controller and GUI which acts as a command and control for the IntruGuard FPGA on the right. This FPGA is engineered specifically to handle DDoS attack mitigation using network behavior analysis (NBA). Network traffic never touches the management logic. The hard disk stores network behavior which is then used to determine whether or not any given resource is actually under attack and to implement filtering against that resource only. This ensures that other network resources are not subject to any type of filtering and prevents inadvertent blocking and limiting.

Now, let’s compare with a competing device:

This very popular competitor is a software solution running on a small thumb drive, connected to the motherboard inside the chassis. Unlike the MitigationPro which is easily serviceable by removing 3 thumbscrews, this competing device is difficult to open and has several of its screws hidden under a warranty caution sticker. It is clear that they do not want their customers looking inside! A quick inspection of the internal components reveals that the entire device is an x86 based server with Linux based management and filtering. The real bottleneck here is the lack of a FPGA. Instead, attack traffic is being filtered in the server’s CPU which, in our field testing, has caused an inherent performance impact and can even result in severe degradation at higher packet per second (PPS) levels.

So what’s the takeaway?

While there is nothing inherently wrong with filtering attacks in an x86 based Linux server, there are performance and reliability considerations that must be taken into account. We would like to ask you the question: “Would you rather have a software based solution and risk performance impact or would you like to have a hardware based solution at a discount of up to 81%?”

To find out more about protecting your network and tapping into the high demand DDoS protection services market, contact Black Lotus MitigationPro at sales@mitigationpro.com or visit http://www.mitigationpro.com