Different Protection Models
DDOS-Guard operates as a reverse proxy and content delivery network. Your DNS records point to DDOS-Guard's infrastructure, and all HTTP/HTTPS traffic passes through their network where it is inspected and filtered. Malicious requests are dropped before they reach your origin server. DDOS-Guard also offers L3/L4 protection through GRE tunnel-based traffic diversion for non-HTTP services.
Flowtriq runs directly on your servers. The FTAgent reads kernel-level network statistics every second, detecting DDoS attacks across all protocols and ports. When an attack is detected, it applies local firewall rules (iptables/nftables) within the same second, then can escalate through BGP FlowSpec, RTBH, and cloud scrubbing as the attack grows.
The key distinction: DDOS-Guard protects your servers from upstream traffic by filtering it before it arrives. Flowtriq protects your servers from all traffic by detecting and mitigating directly on the machine. These are complementary approaches, not competing ones.
Architecture Comparison
| Dimension | DDOS-Guard | Flowtriq |
|---|---|---|
| Protection model | Reverse proxy + CDN + GRE tunnels | On-node agent with 4-level mitigation |
| HTTP/HTTPS protection | Yes (primary strength) | Yes (via kernel-level detection) |
| Non-HTTP protocols | GRE tunnel mode for L3/L4 | Native detection for all protocols |
| Origin IP visibility | Hidden behind proxy (if configured correctly) | N/A (runs on the server directly) |
| Detection speed | Depends on proxy pipeline | Under 1 second per node |
| Per-server visibility | Per-domain or per-IP | Per-server with independent baselines |
| PCAP forensics | Not available (traffic cleaned upstream) | Full PCAP for every incident |
| SSL termination | At DDOS-Guard edge (requires cert upload) | Not required (monitors at network level) |
Where DDOS-Guard Fits Well
DDOS-Guard works well for organizations that primarily need HTTP/HTTPS protection and want an external proxy to absorb traffic before it reaches the origin server.
- Web-only services where all traffic is HTTP/HTTPS and can be proxied
- Organizations that want origin IP hiding as part of their defense strategy
- Content-heavy sites that benefit from CDN caching alongside DDoS protection
- Budget-focused operators looking for combined CDN + DDoS protection in a single service
Where Flowtriq Fits Well
Flowtriq works well for operators running non-HTTP services, managing multi-node infrastructure, or needing per-server forensics and visibility.
- Game servers, VoIP, mail servers and other non-HTTP services that cannot be proxied
- Hosting providers managing hundreds of customer servers with different service types
- Infrastructure behind existing proxies that needs detection for direct-to-origin attacks
- Operators who need PCAP evidence for compliance, incident reporting, or customer communication
- Multi-node environments where each server needs independent monitoring and baselines
The Origin IP Problem
Proxy-based services like DDOS-Guard rely on hiding your origin server's real IP address. If an attacker discovers the origin IP through DNS history records, certificate transparency logs, email headers, or other information leaks, they can target it directly, bypassing the proxy entirely.
Flowtriq runs on the origin server itself. If an attacker discovers and targets the origin IP, Flowtriq detects the attack in under 1 second and applies firewall rules locally. This is particularly relevant for operators who have previously exposed their origin IPs or who run services that reveal server addresses by design.
Using Both Together
The strongest posture combines upstream filtering with local detection:
- DDOS-Guard filters HTTP/HTTPS traffic upstream before it reaches your servers
- Flowtriq monitors each server directly for attacks that bypass the proxy or target non-HTTP services
- If origin IPs are discovered, Flowtriq provides the local defense that proxy-based protection cannot
- PCAP forensics from Flowtriq document every incident regardless of where the attack was filtered
Try Flowtriq free for 14 days. Agent-based detection for all protocols and ports. Sub-second response, PCAP forensics, and automated mitigation on your existing servers. No credit card required. Start your trial.