⚡ MADE IN EUROPE
DDoS mitigation
With NBIP NaWas’s DDoS mitigation, downtime caused by DDoS attacks is a thing of the past. Discover the largest European-made DDoS mitigation platform for critical and vital digital infrastructure and services.
Key figures
Years in operation
🇪🇺
Made in Europe
The problem
DDoS mitigation is a matter of seconds
A volumetric attack can completely overwhelm your uplinks within 60 seconds. By the time your team has been alerted, briefed, and is coordinating a response, your customers will already be calling. That is the window of opportunity that NBIP NaWas’s DDoS mitigation closes.
Most network operators face the same challenge: DDoS attacks are unpredictable and do not occur daily. Investments in mitigation capacity and the necessary expertise are costly and complex. At the same time, DDoS attacks can cause serious and prolonged disruption to service delivery. You need to be prepared, but not at any cost.
NaWas solves this. You get enterprise-grade DDoS mitigation capacity, scaled to handle both large-scale and complex attacks, which you can use when you need it. Thanks to the collaborative, non-profit structure, you never pay too much.
With NaWas, all providers and organisations that need it can make use of attractively priced DDoS mitigation without commercial pressure.
How it works
Fast DDoS mitigation
As soon as you detect a DDoS attack on your network, you can redirect traffic for the target’s prefix via BGP through NaWas. There, the malicious traffic is separated from the legitimate traffic, after which the clean traffic is sent back to the subscriber. Your customers remain online and, in most cases, are unaware of the incident. NBIP engineers monitor all attacks mitigated by NaWas in real time at the NBIP NOC. They intervene if necessary.
The NaWas team has many decades of experience in DDoS mitigation, gained from working with global DDoS mitigation providers, amongst others. In recent years, the NaWas infrastructure has been completely renewed, expanded, and made redundant. NaWas’s capacity has been substantially expanded and work is in full swing on new functionalities and features. The team is also working on a distributed architecture based on open source, which will significantly expand both capacity and the number of points of presence.
Detected attack
Your monitoring system detects unusual traffic and flags it as a DDoS attack.
Detection
Traffic via NaWas
You decide when to route traffic through NaWas. This can also be automated based on thresholds.
Check
DDoS mitigation
Mitigation begins within seconds of traffic being rerouted via NaWas. Clean traffic is sent back via a dedicated private VLAN.
ReRouting
Attack stops
Once the attack has been successfully mitigated and has stopped, the traffic can be restored. You will receive a report on the attack, including details such as the volume and type(s) of attack.
Reporting
On demand or always-on
NaWas has been set up as an on-demand service. However, it may be preferable to have always-on DDoS mitigation in place. In that case, we will examine the specific situation and how we can meet your needs through custom made arrangements.
For most NaWas participants, on-demand DDoS mitigation is sufficient. They only route their traffic via NaWas when they are under attack.
- ✓No latency overhead during normal operations
- ✓Low costs based on IP space
- ✓Suitable for most use cases
- ✓Manual or automatic routing
Some sectors and organisations are frequently subjected to large-scale and/or complex DDoS attacks. For them, on-demand DDoS mitigation is not always sufficient. That is why NaWas also offers custom-made on-demand DDoS mitigation.
- ✓Maximum protection
- ✓Suitable for finance, the public sector
and mission-critical infrastructure - ✓Can be combined with on-demand
DDoS mitigation
DDoS attacks do not wait
Would you like to find out more about NaWas’s DDoS mitigation services? Please get in touch with us and request a service description.
DDoS mitigation by Nawas – types of attack
NaWas mitigates these types of attacks
From volumetric attacks to DNS amplification — NaWas tackles the attacks that cripple networks.
Volumetric attacks
UDP floods, ICMP floods and amplification attacks (DNS, NTP, memcached) are mitigated on a large scale before your uplinks become overloaded. NaWas handles the bandwidth — ensuring your network retains its capacity for legitimate traffic.
Protocol attacks
SYN floods and other attacks that exhaust system capacity are blocked at network level. Your routers, firewalls and load balancers remain unaffected.
DNS DDoS mitigation
DNS amplification attacks and DNS floods targeting resolvers or authoritative servers are filtered upstream. You do not need to change your DNS configuration — the protection is applied at network level.
FOR who
These organisations use NaWas’s DDoS mitigation services
NaWas has a highly diverse customer base, with millions of IP addresses in total. From web hosting to critical applications with hundreds of thousands of visitors a day: NaWas protects it all..
Digital infrastructure providers
Finance
Government and public sector
Want to find out more? Request the NaWas service description
Frequently Asked Questions (FAQ)
NaWas is working hard on a “distributed network architecture” that will be available in as many European countries as possible. With NaWas, you can request an overview of all available locations. The distributed network architecture will soon be operational outside Europe as well.
All parties with their own AS number can connect to the NaWas.
To connect to the NaWas, a port must be available at one of the following parties: AMS-IX, ERA-IX (Amsterdam/Frankfurt/Vienna), NL-ix, LINX, Top-IX, MIX, VIX. You can also connect to the NaWas with a cloud interconnect from DCspine or Equinix Fabric.
If you don’t have a port at one of the connected Internet Exchanges, NaWas can return the clean traffic via a GRE tunnel.
NaWas is part of NBIP; a non-profit foundation established by the internet community and technical specialists. This means that its operation and connection are easily understood by the target audience. The goal is to make the internet safer. By connecting to NaWas, you make the internet a bit safer.
NaWas participates in multiple initiatives, such as the Anti-DDoS Coalition, and shares knowledge with its own participants and several universities, like the University of Twente (UT). Additionally, NaWas also contributes to the development of non-profit institutes such as the DDoS ClearingHouse.
The NaWas infrastructure is developed as an on-demand service. After detection of an attack, the traffic is routed via BGP to NaWas hardware, and then the mitigation process begins. We redirect the traffic through our own connections. This means you don’t have to invest in extra capacity yourself, which will save you costs. After the attack, the traffic is routed back, so it no longer passes through NaWas. As a result, NaWas only needs to be set up based on attack traffic, keeping costs low. Currently, NaWas is exploring the possibilities of offering an always-on solution.
The mitigation process starts within a few minutes after the traffic is redirected to NaWas hardware.
Attacks can be detected either manually or using an automated tool. NaWas recommends installing detection tools, as attacks occur 24 hours a day. NaWas has extensive knowledge of Fastnetmon and GENIE ATM tools and can assist with the supply and implementation of detection tools
You can sign up immediately by using the contact form on the website, by sending an email to bureau@nbip.nl or, in the event of a direct attack, by sending an email to support@nbip.nl
NaWas is among the largest anti-DDoS scrubbing centers in Europe. However, more important is how large and numerous the connections of our participants and the network are. This determines how efficiently NaWas can process attacks.
NaWas operates three mitigation platforms, two of which are located in a redundant setup in Amsterdam and one in Denmark. NaWas is developing a ‘distributed architecture’ that enables traffic to be mitigated on a global scale.
In relation to the OSI model, NaWas can mitigate DDoS traffic on all layers. For Layer 7 (application layer), NaWas will mitigate based on header fields and not through (deep) packet inspection.
NaWas uses a multi-vendor setup where multiple Triple A vendor devices are arranged in line (funnel). The operation is comparable to a car wash, where multiple devices in sequence first wash the rough part and later the smaller parts, thus removing attack traffic. NaWas continuously innovates the anti-DDoS solution and always applies the most effective and newest techniques.
The pricing model consists of a flat-fee model. The price is determined by the number of prefixes (based on /24) you want to protect. You pay slightly more for larger quantities. Prices are invoiced on a monthly, quarterly, or yearly basis.
In addition to the fee for NaWas, you pay a small monthly contribution for NBIP membership and a one-time contribution for the setup. Due to the non-profit nature of the services, the costs are low compared to similar services from other providers.
NaWas has a BGP session with participants on the clean side (with IXPs) on a private VLAN. A member can redirect a specific prefix or /24 by advertising that prefix on the NaWas BGP session. NaWas advertises the prefix on our upstreams (transits & peering). So the trigger for redirecting is done manually or automated by the participants.
After receiving a prefix or receiving a new DDoS attack on an existing prefix, the NaWas support team receives a notification of the event. The support team checks if the attack is being mitigated well enough and if adjustment is necessary. When the attack is over, the member receives an email with a report on the details of the attack.
If an attack lasts longer, NaWas sends an interim report. Participants can view the report on the portal.
Yes, the internet does not accept subnets smaller than a /24. However, we are working on an architecture based on a /32 setup that can be used alongside the /24.
In principle, there is no packet loss. Parties that don’t yet know the more specific follow the less specific. Learning the more specific happens very quickly, usually within a few seconds.
The more parties know the more specific, the more the attack traffic disappears. We assume that clean traffic still passes through. Furthermore, it depends very much on the type of attack to what extent the mitigation systems can immediately reduce the malicious traffic. Most attacks are mitigated immediately. In some cases, it may take a few seconds
In some cases, a portion of the attack traffic below a certain threshold may still be allowed through. If that’s the case, the advice is to contact NaWas as soon as possible if the residual traffic causes disruption. After advertising, traffic will route through NaWas within a second, and it may take a few seconds for the entire internet to know the route.
