Detect. Mitigate.
Stay online.
Flowtriq runs directly on your servers, detects DDoS attacks in under a second, and automatically deploys BGP FlowSpec rules, RTBH blackholes, and cloud scrubbing to stop them. Full PCAP evidence and instant alerts on Slack, Discord, or PagerDuty.
How It Works
Up and running in four steps
From install to first mitigation in under five minutes. No manual threshold tuning needed.
Deploy the Agent
Two commands. The FTAgent installs on any Linux server, reads packets directly from the NIC, and connects to your Flowtriq workspace.
sudo ftagent --setup
Detect & Classify
Flowtriq learns your baseline, then detects and classifies attacks (UDP flood, SYN flood, DNS amp, HTTP flood) with confidence scoring and IOC matching.
Auto-Mitigate
BGP FlowSpec rate-limits, RTBH blackholes, and cloud scrubbing deploy automatically based on escalation policies you define. No manual intervention.
Alert & Report
Alerts fire to Discord, Slack, PagerDuty, email, or SMS within a second. Full PCAP forensics capture every attack for post-incident analysis.
Features
Built for infrastructure teams
who run real servers.
Purpose-built for NOC teams, hosting providers, game server operators, and infrastructure engineers who need detection, mitigation, and clarity during an attack — not noise.
Sub-Second Detection
Traffic is sampled every second. Attacks are detected the moment they start, not minutes later on a polling interval.
Learn more →Auto-Mitigation
BGP FlowSpec rate-limits, RTBH blackholes, and cloud scrubbing deploy automatically via escalation policies you define.
Learn more →Attack Classification
Automatically identifies UDP floods, SYN floods, HTTP floods, ICMP floods, DNS amplification, and multi-vector attacks.
Learn more →Full Packet Capture
PCAP files include pre-attack traffic so you can see the ramp-up. Stream captures to the dashboard during active attacks.
Learn more →IOC Pattern Matching
Identify known botnets like Mirai and LOIC by matching packet payloads against built-in and custom indicator patterns.
Learn more →Multi-Channel Alerts
Route alerts to Discord, Slack, PagerDuty, OpsGenie, SMS, email, or webhooks. Configure per-severity escalation policies.
Learn more →Dynamic Baselines
Learns your normal traffic patterns and auto-adjusts thresholds continuously. No manual tuning or guesswork required.
Learn more →Cloud Scrubbing
Trigger Cloudflare Magic Transit, OVH VAC, or Hetzner DDoS protection automatically when attacks escalate beyond BGP.
Learn more →Immutable Audit Log
Every action is logged: incidents opened, PCAPs downloaded, mitigation rules deployed, API keys rotated. Full accountability.
Learn more →Integrations
Works with your stack
Connect to the tools your team already uses. Alerts, mitigation rules, cloud scrubbing, and reporting fire automatically when attacks hit.
Pricing
Simple, honest pricing
Flat per-node pricing. No traffic-volume surcharges, no per-alert fees, no seat limits.
Everything you need, billed by the server. Scale up or down instantly.
- Unlimited incidents per node
- Auto-mitigation (BGP + cloud scrub)
- PCAP capture (7-day retention)
- All 7+ alert channels
- Full attack classification
- 7-day free trial
Volume discounts, dedicated support, PCAP retention up to 365 days, SSO, and SLA guarantees.
- Everything in Per Node
- Volume pricing (50+ nodes)
- 365-day PCAP retention
- Dedicated Slack channel
- Custom IOC library
- 99.9% uptime SLA