Emergency DDoS protection: deploy
mid-attack in minutes

Back to Blog

When You Are Already Under Attack

Most DDoS protection products assume you are buying before an attack happens. The sales process takes weeks. Hardware deployment takes longer. Configuration and tuning happen over days of professional services engagement. The entire model assumes you have time.

When you are actively under attack, you do not have time. Your services are degraded or down. Your NOC is in incident mode. Your customers are opening tickets. Every minute without protection is a minute of lost revenue, lost trust, and accumulating damage.

The question is not "which DDoS vendor has the best features." The question is "what can I deploy right now, while my servers are being hit, that will start helping immediately."

Why Most Solutions Cannot Help Mid-Attack

The majority of DDoS protection products have deployment requirements that make mid-attack installation impractical or impossible:

• Hardware appliances (Corero SmartWall, Arbor TMS, FortiDDoS) require physical delivery, racking, cabling, and inline network configuration. Lead time: days to weeks.
• Cloud scrubbing services (Akamai Prolexic, Cloudflare Magic Transit, Radware) require BGP session setup, GRE tunnel configuration, or DNS delegation changes. These are feasible mid-attack but still require coordination and typically take hours to provision.
• Enterprise software solutions that require a POC, sales approval, and professional services deployment are off the table entirely during an active incident.
• Any product that requires a "contact sales" step before you can access it is unusable during an emergency. Sales teams do not operate on incident timelines.

This is the gap that emergency deployment fills. You need a product that works the moment you install it, with no dependencies on hardware, no network rearchitecture, and no vendor coordination.

Deploy During a Live Attack: Step by Step

Here is the actual process for deploying Flowtriq while you are under active DDoS attack. This is not a simplified marketing version. This is what you do.

Step 1: Sign Up (30 seconds)

Go to flowtriq.com and create an account. There is no sales form, no approval step, and no waiting period. You get immediate access to the dashboard and your installation command.

Step 2: Install the Agent (under 1 minute)

SSH into your server and run the installation command. It is a single line that downloads and installs the agent binary. The agent starts immediately.

# Install ftagent (single command)
curl -sSL https://get.flowtriq.com | bash

The agent runs as a lightweight process on your server. It does not require a reboot, does not modify your network configuration, and does not interrupt existing services. It starts capturing traffic the moment it launches.

Step 3: Immediate Attack Detection

Because you are already under attack, the agent does not need to wait for baseline learning to detect the anomaly. The incoming attack traffic is immediately visible. The agent classifies the attack vectors in real time: SYN flood, UDP amplification, DNS reflection, NTP monlist, or whatever the attacker is throwing at you.

Within seconds of installation, your dashboard shows exactly what is hitting your server, at what volume, from which sources, and using which protocols. You go from "we are under attack and do not know what is happening" to "we can see the exact attack profile" in under two minutes.

Step 4: Automated Mitigation Fires

The agent can deploy on-server firewall rules automatically when it detects attack traffic. For common volumetric vectors like UDP amplification and SYN floods, the mitigation rules activate without manual intervention. The agent identifies the attack signature, generates targeted iptables/nftables rules, and drops the malicious traffic at the kernel level.

For attacks that exceed the server's capacity to filter locally, the agent can trigger BGP FlowSpec rules or RTBH announcements upstream, pushing the filtering to your transit providers or scrubbing center. This escalation happens automatically based on the severity of the attack.

Step 5: Visibility and Forensics

While the mitigation is active, the dashboard provides real-time visibility into the attack. You can see traffic volumes, protocol breakdown, source analysis, and the effectiveness of the mitigation rules. PCAP capture runs in parallel, giving you packet-level forensics for post-incident analysis.

Real-World Emergency Deployment

A European telecom ISP came to Flowtriq while experiencing a sustained volumetric attack. They signed up, deployed the agent across their infrastructure, and were detecting and classifying a 578 Mbps attack within hours of first contact. The agent identified the attack vectors immediately upon installation, and auto-mitigation rules began filtering malicious traffic on the affected nodes.

The critical point is that they did not need to wait for baseline learning to complete. The attack itself was the anomaly, and the agent recognized it immediately. Baseline learning continued in the background, refining detection sensitivity for future attacks, while the immediate threat was being actively mitigated.

You do not need a baseline to detect an obvious attack. When a server that should be receiving 50 Mbps is being hit with 578 Mbps, the anomaly is self-evident. Baselines matter for detecting subtle, low-volume attacks. During an active emergency, the agent detects the obvious threat immediately.

Emergency Deployment Checklist

If you are reading this during an active attack, here is the condensed version:

1. Sign up: flowtriq.com/signup (30 seconds)
2. Copy your install command from the dashboard
3. SSH into the affected server and paste the command
4. Check your dashboard. You should see attack traffic within 60 seconds
5. Enable auto-mitigation if it is not already on by default
6. Set up alerts (Discord, Slack, PagerDuty) so your team is notified of changes
7. Repeat on additional servers if multiple nodes are affected

Total deployment time for one server: under 5 minutes. For a cluster of 10 servers: under 15 minutes. You can deploy in parallel across multiple servers simultaneously.

After the Emergency

Once the immediate attack is mitigated, the agent continues running and learning. The baseline model builds over the following hours and days, learning your server's normal traffic patterns. Future attacks are detected against this baseline, making detection more sensitive to subtle anomalies that might not trigger during the initial "everything is obviously broken" phase.

Post-attack, you also have full forensic data. The PCAP captures, traffic logs, attack timelines, and source analysis are all available in the dashboard. This data is valuable for incident reports, insurance claims, law enforcement referrals, and understanding the attack profile so you can harden your defenses for next time.

Do Not Wait for the Next Attack

Emergency deployment works. We designed the product to be installable during a live incident because that is how many operators first encounter the need for DDoS protection. But the best time to deploy is before the next attack, not during it.

If you are reading this after an attack ended and you are evaluating your options, install the agent now. Let the baselines learn during normal traffic. Configure your alerts and mitigation rules while you are not under pressure. When the next attack comes, the system is already in place, the baselines are established, and detection fires within seconds rather than requiring manual installation under stress.

Back to Blog

Related Articles