FortiDDoS vs Flowtriq:
Hardware DPI vs Software-Defined Detection

Back to Blog

We make Flowtriq. FortiDDoS (Fortinet) is a competitor. This comparison names both products directly and tries to give FortiDDoS fair treatment where it earns it. FortiDDoS has genuine architectural strengths that Flowtriq does not replicate, and we will be specific about what those are.

Different Architectures for the Same Problem

FortiDDoS is an ASIC-based inline hardware appliance. It sits in the traffic path, inspects every packet using purpose-built silicon, and mitigates attacks at line rate without CPU overhead. This is a hardware-first approach: the detection and mitigation logic is implemented in custom ASICs rather than general-purpose processors.

Flowtriq is a software agent that runs on each server. It monitors traffic on the server's network interface, builds per-second baselines, classifies attacks into eight families with confidence scoring, captures PCAP evidence, and triggers auto-mitigation through firewall rules, FlowSpec, RTBH, or scrubbing center escalation.

Both products detect DDoS attacks. They do it in fundamentally different ways, and those architectural differences determine everything: capacity model, scaling path, operational overhead, cost structure, and what data you get during an incident.

What FortiDDoS Does

FortiDDoS uses custom ASICs to perform deep packet inspection at line rate. Every packet is inspected without sampling and without taxing the system CPU. This is a genuine engineering achievement. The appliance can process traffic at its rated throughput (typically 10 Gbps) with consistent latency regardless of traffic composition or attack complexity.

The ASIC approach means FortiDDoS does not face the trade-off that software-based DPI systems encounter: as traffic volume increases, software DPI eventually hits CPU limits and must either sample or degrade. FortiDDoS's ASICs maintain full inspection at rated capacity.

FortiDDoS operates inline, meaning it sits in the physical traffic path and can drop attack packets before they reach your servers. Detection and mitigation happen in the same device, with no delay between identifying an attack and filtering it. For environments where inline hardware mitigation at line rate is a hard requirement, FortiDDoS delivers.

The appliance model means FortiDDoS is a fixed-capacity system. The detection and mitigation capability is defined by the appliance tier you purchased. It protects everything behind it in the network path, but only what is behind it.

What Flowtriq Does

Flowtriq takes a different approach. Instead of a single inline appliance, Flowtriq deploys a lightweight agent on each server. Each agent monitors its server's network interface, builds a traffic baseline specific to that server, and detects anomalies against that baseline at one-second resolution.

When an attack is detected, the agent produces a full incident record: attack classification across eight families (SYN flood, UDP flood, DNS amplification, NTP amplification, ICMP flood, HTTP flood, TCP ACK flood, multi-vector) with confidence scoring, per-second PPS and Mbps time series, complete source IP census with AS and country data, target port breakdown, packet size distribution, and a PCAP capture with pre-attack buffer.

Auto-mitigation triggers within one to two seconds of detection. The escalation chain starts with local firewall rules (iptables/nftables), then FlowSpec, then RTBH, then scrubbing center diversion. Each level only activates if the previous level is insufficient. Alerts fire to Discord, Slack, PagerDuty, OpsGenie, email, SMS, and webhooks.

Flowtriq does not do inline hardware DPI. It does not sit in the traffic path. It does not filter packets before they reach your server. Those are FortiDDoS's capabilities.

The Pricing Gap

FortiDDoS is an enterprise hardware platform with enterprise pricing. The cost structure includes the appliance itself, annual licensing and support, and specialist staff to operate it.

• FortiDDoS appliance (10 Gbps tier): $50,000 - $100,000+ depending on model and channel
• Higher-tier appliances: $100,000 - $200,000+
• Annual licensing and support: 18-22% of appliance cost per year
• Specialist staff or professional services: FortiDDoS requires Fortinet-specific expertise for configuration, tuning, and ongoing management

Flowtriq pricing is public: $9.99/node/month on monthly billing, $7.99/node/month on annual billing. All features included on every node. No hardware. No per-module pricing. No feature tiers.

The gap is significant. For organizations with existing Fortinet infrastructure and staff, FortiDDoS's incremental cost may be more manageable. For organizations evaluating DDoS detection without existing Fortinet investment, the pricing difference is hard to justify unless inline hardware DPI is a non-negotiable requirement.

Capacity and Scaling

FortiDDoS appliances have a fixed throughput rating. The typical deployment is 10 Gbps. When your legitimate traffic grows toward that ceiling, your available headroom for absorbing attack traffic shrinks. Scaling means either stacking additional appliances (doubling CapEx and adding operational complexity) or replacing the unit with a higher-tier model (another six-figure purchase).

This is not a deficiency. It is how hardware appliances work. But it creates a capacity planning obligation that compounds with traffic growth. Every 18-24 months, you are re-evaluating whether your current appliance tier is sufficient.

Flowtriq agents monitor independently on each server. There is no aggregate capacity limit. When you add servers, you add agents. When traffic grows on existing servers, baselines adapt. The capacity of your detection infrastructure scales linearly with your server fleet without hardware procurement decisions.

For organizations with stable, predictable traffic, FortiDDoS's fixed capacity is manageable. For organizations with growth trajectories that are harder to predict, the software model avoids the periodic capacity cliff that hardware creates.

Detection and Classification

FortiDDoS performs DPI at the packet level using its ASICs. It can classify attack traffic based on deep inspection of packet contents, protocol behavior, and traffic patterns. This is a genuine strength. ASIC-based classification does not degrade under load the way software-based DPI can, and the inspection depth is real.

Flowtriq classifies attacks into eight families with confidence scoring by analyzing packet headers, port distributions, packet sizes, source IP patterns, and traffic behavior at per-second resolution. Each attack vector in a multi-vector incident gets its own classification and confidence percentage.

Both products provide attack classification. The mechanisms differ. FortiDDoS uses hardware DPI at the network edge. Flowtriq uses statistical analysis at the server level. FortiDDoS sees everything that crosses the appliance. Flowtriq sees everything that reaches each individual server, which means it has per-server context that a network-edge appliance lacks: what is normal for this specific server, how this attack compares to this server's baseline, and what the server is actually experiencing.

One area where Flowtriq provides data that FortiDDoS does not: automatic PCAP capture for every incident, with a pre-attack buffer. FortiDDoS can capture packets at the appliance, but it does not automatically generate per-incident PCAP files with pre-attack context. For forensics, abuse reports, and post-incident analysis, PCAP evidence is the difference between "we detected elevated traffic" and "here are the actual packets."

Deployment and Operations

FortiDDoS deployment is a multi-week project. The appliance needs to be racked, cabled inline, configured with protection policies, and tuned against your traffic patterns. Policy configuration requires Fortinet-specific expertise. Most operators report weeks of tuning before detection policies are accurate for their environment.

Ongoing operations include firmware management (testing updates before production deployment), hardware monitoring, capacity planning, and policy maintenance as traffic patterns change. When firmware updates change policy behavior, operators spend additional time re-validating and re-tuning.

Flowtriq deployment is a single command per server. The agent installs, auto-detects interfaces, and starts building baselines immediately. Detection is operational within minutes. No network topology changes, no inline placement, no Fortinet expertise required. A 100-node deployment can be completed in an afternoon.

Ongoing operations are minimal. Agent updates are automatic. Baselines adapt dynamically. There is no firmware to manage, no hardware to monitor, and no capacity to plan around.

When to Choose Each

Choose FortiDDoS when:

• You need inline hardware DPI at line rate and have the budget and staff to operate it.
• Your environment requires inline packet filtering before traffic reaches servers, and upstream/software-based mitigation is not sufficient.
• You are already invested in the Fortinet ecosystem (FortiGate, FortiManager, FortiAnalyzer) and want integration with the Security Fabric.
• Compliance or contractual requirements specify on-premise appliance-based DDoS mitigation.
• Your traffic is predictable enough that the appliance's fixed capacity provides adequate headroom for the foreseeable future.

Choose Flowtriq when:

• You need per-server DDoS detection without CapEx, hardware procurement, or specialist staff.
• Your infrastructure spans data centers, cloud, edge locations, and colocation facilities that a single appliance cannot cover.
• You need automatic PCAP capture, eight-family attack classification with confidence scoring, and per-second detection granularity.
• You want self-tuning baselines that work out of the box without weeks of manual policy configuration.
• Your budget does not support six-figure appliance purchases and ongoing Fortinet licensing.
• You need detection with auto-mitigation escalation (local rules, FlowSpec, RTBH, scrubbing) rather than inline filtering.

Using Both Together

For organizations that already have FortiDDoS at the network edge, adding Flowtriq on the servers behind it creates a layered detection architecture.

FortiDDoS handles inline filtering. It continues to inspect and drop attack traffic at the network edge using ASIC-based DPI. This is what it was built for, and it does it well.

Flowtriq handles per-server visibility. Agents on each server provide:

• Mitigation validation: Confirm what percentage of attack traffic FortiDDoS is filtering versus what reaches each server. Quantitative data for tuning FortiDDoS policies.
• Below-threshold detection: Attacks that are small enough to pass through FortiDDoS's aggregate thresholds but anomalous for specific servers. These are the attacks that cause problems when left undetected.
• Per-server forensics: PCAP captures showing exactly what each server experienced during an incident. Classification and source analysis from the server's perspective.
• Coverage beyond the appliance: Cloud instances, remote edge nodes, and infrastructure outside FortiDDoS's inline path get the same detection depth.

This is not a theoretical architecture. Network-edge filtering plus per-server detection is the standard layered model for organizations that need both active mitigation and deep visibility.

Frequently Asked Questions

Back to Blog

Related Articles