Detect. Mitigate.
Stay online.
Flowtriq runs directly on your servers, detects DDoS attacks in under a second, and automatically deploys BGP FlowSpec rules, RTBH blackholes, and cloud scrubbing to stop them. Full PCAP evidence and instant alerts on Slack, Discord, or PagerDuty.
How It Works
Up and running in four steps
From install to first mitigation in under five minutes. No manual threshold tuning needed.
Deploy the Agent
Two commands. The FTAgent installs on any Linux server, reads packets directly from the NIC, and connects to your Flowtriq workspace.
sudo ftagent --setup
Detect & Classify
Flowtriq learns your baseline, then detects and classifies attacks (UDP flood, SYN flood, DNS amp, HTTP flood) with confidence scoring and IOC matching.
Auto-Mitigate
BGP FlowSpec rate-limits, RTBH blackholes, and cloud scrubbing deploy automatically based on escalation policies you define. No manual intervention.
Alert & Report
Alerts fire to Discord, Slack, PagerDuty, email, or SMS within a second. Full PCAP forensics capture every attack for post-incident analysis.
Features
Built for infrastructure teams
who run real servers.
Purpose-built for NOC teams, hosting providers, game server operators, and infrastructure engineers who need detection, mitigation, and clarity during an attack — not noise.
Sub-Second Detection
Traffic is sampled every second. Attacks are detected the moment they start, not minutes later on a polling interval.
Learn more →Auto-Mitigation
BGP FlowSpec rate-limits, RTBH blackholes, and cloud scrubbing deploy automatically via escalation policies you define.
Learn more →Attack Classification
Automatically identifies UDP floods, SYN floods, HTTP floods, ICMP floods, DNS amplification, and multi-vector attacks.
Learn more →Full Packet Capture
PCAP files include pre-attack traffic so you can see the ramp-up. Stream captures to the dashboard during active attacks.
Learn more →IOC Pattern Matching
Identify known botnets like Mirai and LOIC by matching packet payloads against built-in and custom indicator patterns.
Learn more →Multi-Channel Alerts
Route alerts to Discord, Slack, PagerDuty, OpsGenie, SMS, email, or webhooks. Configure per-severity escalation policies.
Learn more →Dynamic Baselines
Learns your normal traffic patterns and auto-adjusts thresholds continuously. No manual tuning or guesswork required.
Learn more →Cloud Scrubbing
Trigger Cloudflare Magic Transit, OVH VAC, or Hetzner DDoS protection automatically when attacks escalate beyond BGP.
Learn more →Immutable Audit Log
Every action is logged: incidents opened, PCAPs downloaded, mitigation rules deployed, API keys rotated. Full accountability.
Learn more →Integrations
Works with your stack
Connect to the tools your team already uses. Alerts, mitigation rules, cloud scrubbing, and reporting fire automatically when attacks hit.
Pricing
Simple, honest pricing
Flat per-node pricing. No traffic-volume surcharges, no per-alert fees, no seat limits.
Everything you need, billed by the server. Scale up or down instantly.
- Unlimited incidents per node
- Auto-mitigation (BGP + cloud scrub)
- PCAP capture (7-day retention)
- All 7+ alert channels
- Full attack classification
- 7-day free trial
Volume discounts, dedicated support, PCAP retention up to 365 days, SSO, and SLA guarantees.
- Everything in Per Node
- Volume pricing (50+ nodes)
- 365-day PCAP retention
- Dedicated Slack channel
- Custom IOC library
- 99.9% uptime SLA
FAQ
Frequently asked questions
What is Flowtriq?
Flowtriq is a real-time DDoS detection and auto-mitigation platform. It installs as a lightweight agent on your Linux servers, monitors every packet, classifies attack types (SYN flood, UDP amplification, DNS reflection, etc.), and can automatically deploy BGP FlowSpec rules, RTBH, or trigger cloud scrubbing — all within one second of detection.
How does Flowtriq detect DDoS attacks?
Flowtriq monitors network traffic in real time using per-packet inspection. It learns your normal traffic baseline, then detects anomalies like sudden spikes in packets-per-second, unusual protocol distributions, or known attack signatures. It classifies attacks into specific types and alerts your team within one second.
How much does Flowtriq cost?
$9.99 per node per month, or $7.99/node/mo on an annual plan. No per-seat charges, no traffic-volume surcharges, no per-alert fees. Every plan includes unlimited incidents, all alert channels, PCAP capture, and auto-mitigation. A 7-day free trial is available with no credit card required.
What alert channels does Flowtriq support?
Discord, Slack, email, SMS, PagerDuty, OpsGenie, and custom webhooks. Alerts fire within one second of detection and include attack type, severity, packets-per-second, and affected node details.
Does Flowtriq offer auto-mitigation?
Yes. Flowtriq can automatically deploy BGP FlowSpec rules, RTBH routing, or trigger cloud scrubbing when an attack is detected. You can configure mitigation rules with thresholds, cooldowns, and specific attack type triggers from the dashboard.
How long does it take to set up?
Under two minutes. Run pip install ftagent, then sudo ftagent --setup with your API key. The agent immediately begins monitoring traffic. You'll see data in your dashboard within seconds of installation.
What is PCAP capture?
When Flowtriq detects an attack, it automatically captures raw packet data (PCAP) for forensic analysis. Download captures from the dashboard, filter by protocol and time range, and use them with tools like Wireshark. Retention is 7 days on standard plans, up to 365 days on enterprise.
Can I monitor multiple servers?
Yes. Install the agent on as many servers as you need and manage them all from one dashboard. Each node is billed independently. You can organize servers into separate workspaces for different teams or clients.