Supported DDoS attack types and signatures

Wanguard does not need a "signature database". Signatures are needed by IDS and IPS products, not by DDoS protection systems, which deal primarily with volumetric attacks. Wanguard differentiates attack types through decoders — internal traffic dissectors that classify the underlying protocols of each packet or flow. You can enable them in Configuration » General Settings » Anomaly Detection; most decoders are hard-coded for performance reasons.

Dozens of built-in decoders are available for defining packets/s, bits/s and percentage thresholds, including:

• Generic: IP, TCP, UDP, ICMP, OTHER, INVALID, FRAGMENT, and FLOWS / FLOW+SYN for flows/s thresholds;
• TCP flags: TCP+SYN, TCP+ACK, TCP+RST, TCP+SYNACK, TCP+FIN, TCP+RST+FIN, TCP+ACK+PSH, TCP-NULL, TCP+ALL (Xmas), TCP0;
• Protocols abused in reflection and amplification attacks: DNS, NTP, SNMP, SSDP, MEMCACHED, LDAP, SIP, QUIC, UDP-QUIC, UDP0;
• Services and applications: HTTP, HTTPS, WWW, MAIL, SSH, RDP, NETBIOS, IPSEC, plus traffic to or from YouTube, Netflix, Hulu and Facebook.

Each decoder is described in detail in the User Guide, and we regularly add or modify decoders based on user feedback. You can also create your own decoders in Configuration » General Settings » Custom Decoders, using BPF (packet) and flow-filtering expressions. In the default configuration, a few high-level thresholds are predefined for the most generic decoders.

Wanguard Sensor can also detect anomalies without previously-set thresholds, through traffic profiling: the software computes a traffic baseline from the past traffic of each profiled prefix and reports any activity that deviates from the expected levels.