About our Anti-DDoS
This document will explain the following:
What is GLAD?
GLAD (Global Low-Latency anti-DDoS protection) is a collection of in-house tools that we offer at i3D.net that can prevent, detect, and thwart a strike. It's important to understand what a "strike" is, what strikes can do to disrupt services, and how our GLAD product can deter such attacks. For more information about how attacks work and how they can impact services, see the DDoS attack types overview.
What is Warden?
Warden is i3D.net's advanced protocol-aware DDoS protection system, operating as a standalone add-on to GLAD Advanced. Unlike traditional DDoS protection that relies on volumetric filtering, Warden provides intelligent traffic analysis at the packet level, making it ideal for gaming, real-time communication, and applications using custom protocols.
Key Benefits of Warden:
Zero latency impact - Direct NIC-level processing bypasses OS overhead
Protocol-specific protection - Understands legitimate vs. malicious traffic patterns
Eliminates false positives - Prevents blocking of legitimate users during attacks
Real-time management - API-driven configuration with sub-second propagation
GLAD features/tools
Below is an explanation of our i3D.net's GLAD's tooling and how each functionality can help to thwart DDoS attacks.
What's included in the Standard package
Automatic detection and auto null route
With automatic detection, it will discover incoming DDoS attacks. Once an attacker network is detected, this service blocks all traffic from it. Also, null routing silently discards (or "drops") malicious incoming traffic. The undesired traffic is directed to a route that goes nowhere, protecting the infrastructure. Null routing renders the target server inaccessible to anyone, including clean traffic.
What's included in the Advanced package:
Advanced also includes the features from the Standard package above.
Rate limiting
If a specific destination IP/port combination is not critical to the continued operation of the application running on the server, it can be set to receive a limited amount of traffic.
It limits total traffic for a destination to a configurable Mbps value, such as “all traffic to a certain destination port.”
If the rate limit is exceeded, the overflow traffic is discarded randomly, affecting both legitimate and illegitimate traffic.
Understanding Rate Limits
Rate limits control the number of requests that a server can receive within a specific timeframe. These limits help maintain service quality and prevent abuse. Once exceeded, further requests may be blocked or delayed until the limit resets.
For example:
If you normally expect 10 Mbps traffic to a certain destination IP & destination port combination, you might decide to set a 20 Mbps rate limit.
But if you then receive a 90 Mbps attack, the 20 Mbps rate limit will drop exceeding 80 Mbps randomly meaning you’ll pass through approximately 4 Mbps of legitimate traffic and 16 Mbps of illegitimate traffic.
This means you effectively have 60% packet loss on your legitimate 10 Mbps of traffic when the rate limit is performing exactly as it was configured to do.
Its usefulness is therefore very limited for the actual application you’re trying to protect; hard discard or accept methods are often more appropriate.
Clients often rate limit ICMP traffic to ensure servers respond to pings during normal operation, but halt responses during ICMP-based DDoS attacks. Meanwhile, the application/protocol/port which runs on the server remains unaffected by this ICMP traffic rate limit.
What's included in the Premium package:
Premium also includes the features from the Advanced and Standard packages above.
Byte matching
Byte matching is a technique that identifies and filters out malicious or undesirable traffic from incoming network packets based on specific byte patterns. Customers can tailor specified signatures. As a result, it blocks the bytes that are not supposed to enter the network by taking appropriate actions to safeguard the targeted infrastructure.
Warden Add-On:
Warden can be added to any GLAD Package to provide enterprise-grade, protocol-aware DDoS protection.
For unparalleled anti-DDoS protection, Warden is our custom software that filters traffic on a dynamic whitelist furnished by the customer. Its capabilities provide inline filtering, which allows you to achieve a higher level of specificity and detail when filtering their traffic stream.
Warden is designed to be flexible and adaptable. New features are continuously added whenever technically feasible, enabling you to benefit from the latest advancements in traffic filtering technology. In the event of server failures, Warden follows a fail-open system. If two servers fail, instead of blocking traffic, Warden allows all traffic to pass through. This ensures that your network remains operational even in challenging situations.
Warden also supports Active-Active setups, allowing horizontal scaling. This means you can expand the capacity of your filtering infrastructure by adding more instances of Warden, distributing the workload, and ensuring scalability.
For more information on integrating Warden, please refer to Warden: Overview of how it works
Product packages overview
Below is an overview of our product packages, detailing the features included.
Default ACL on VLAN
X
X
X
Automatic detection and auto null-route
X
X
X
Custom ACL on VLAN
-
X
X
Rate limiting
-
X
X
Byte matching
-
-
X
API Access
-
-
X
Priority Support
-
-
X
+ Warden
+ Warden
+ Warden
Dynamic IP Whitelisting
X
X
X
Advanced Payload Fingerprinting
X
X
X
Protocol-Aware Intelligence
X
X
X
Zero-Latency Processing
X
X
X
Getting Started
GLAD packages are available immediately upon service activation
Warden add-on requires initial configuration consultation
API access is provided with comprehensive documentation at https://glad-api.i3d.net/
For more information on integrating Warden, please refer to Warden: Overview of how it works
Related topics
GLAD API reference: https://glad-api.i3d.net/
Last updated
Was this helpful?