{"id":53591,"date":"2024-12-02T11:02:13","date_gmt":"2024-12-02T10:02:13","guid":{"rendered":"https:\/\/www.nbip.nl\/nawas\/faq\/"},"modified":"2026-06-09T12:08:26","modified_gmt":"2026-06-09T10:08:26","slug":"faq","status":"publish","type":"page","link":"https:\/\/www.nbip.nl\/en\/nawas\/faq\/","title":{"rendered":"FAQ"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

FAQ<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Frequently asked questions about the NaWas<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhere is the NaWas available?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas is working hard on a “distributed network architecture” that will be available in as many European countries as possible. With NaWas, you can request an overview of all available locations. The distributed network architecture will soon be operational outside Europe as well.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWho can connect to the NaWas?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

All parties with their own AS number can connect to the NaWas.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat is technically required to connect to the NaWas?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

To connect to the NaWas, a port must be available at one of the following parties: AMS-IX, ERA-IX (Amsterdam\/Frankfurt\/Vienna), NL-ix, LINX, Top-IX, MIX, VIX. You can also connect to the NaWas with a cloud interconnect from DCspine or Equinix Fabric.<\/p>

If you don\u2019t have a port at one of the connected Internet Exchanges, NaWas can return the clean traffic via a GRE tunnel.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow does the NaWas distinguish itself from other providers of anti-DDoS services?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas is part of NBIP; a non-profit foundation established by the internet community and technical specialists. This means that its operation and connection are easily understood by the target audience. The goal is to make the internet safer. By connecting to NaWas, you make the internet a bit safer.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat does NaWas do specifically to make the internet safer?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas participates in multiple initiatives, such as the Anti-DDoS Coalition<\/a><\/strong>, and shares knowledge with its own participants and several universities, like the University of Twente (UT). Additionally, NaWas also contributes to the development of non-profit institutes such as the DDoS ClearingHouse.\u00a0<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDoes NaWas offer \"Always-On\" or \"On-Demand\" services?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

The NaWas infrastructure is developed as an on-demand service. After detection of an attack, the traffic is routed via BGP to NaWas hardware, and then the mitigation process begins. We redirect the traffic through our own connections. This means you don’t have to invest in extra capacity yourself, which will save you costs. After the attack, the traffic is routed back, so it no longer passes through NaWas. As a result, NaWas only needs to be set up based on attack traffic, keeping costs low. Currently, NaWas is exploring the possibilities of offering an always-on solution.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow quickly does NaWas work after detecting an attack?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

The mitigation process starts within a few minutes after the traffic is redirected to NaWas hardware.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow and where are attacks detected?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

Attacks can be detected either manually or using an automated tool. NaWas recommends installing detection tools, as attacks occur 24 hours a day. NaWas has extensive knowledge of Fastnetmon and GENIE ATM tools and can assist with the supply and implementation of detection tools<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow can I contact NaWas?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

You can sign up immediately by using the contact form on the website, by sending an email to bureau@nbip.nl<\/a> or, in the event of a direct attack, by sending an email to support@nbip.nl<\/a><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat is the current scrubbing capacity of NaWas?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas is among the largest anti-DDoS scrubbing centers in Europe. However, more important is how large and numerous the connections of our participants and the network are. This determines how efficiently NaWas can process attacks.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDoes NaWas have a redundant setup?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas operates three mitigation platforms, two of which are located in a redundant setup in Amsterdam and one in Denmark. NaWas is developing a \u2018distributed architecture\u2019 that enables traffic to be mitigated on a global scale.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tFor what type of traffic does NaWas work?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

In relation to the OSI model, NaWas can mitigate DDoS traffic on all layers. For Layer 7 (application layer), NaWas will mitigate based on header fields and not through (deep) packet inspection.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow many and which components make up the functional structure of the scrubbing center?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas uses a multi-vendor setup where multiple Triple A vendor devices are arranged in line (funnel). The operation is comparable to a car wash, where multiple devices in sequence first wash the rough part and later the smaller parts, thus removing attack traffic. NaWas continuously innovates the anti-DDoS solution and always applies the most effective and newest techniques.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat are the costs involved in connecting to NaWas?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

The pricing model consists of a flat-fee model. The price is determined by the number of prefixes (based on \/24) you want to protect. You pay slightly more for larger quantities. Prices are invoiced on a monthly, quarterly, or yearly basis.<\/p>

In addition to the fee for NaWas, you pay a small monthly contribution for NBIP membership and a one-time contribution for the setup. Due to the non-profit nature of the services, the costs are low compared to similar services from other providers.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow do you activate a redirect?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

NaWas has a BGP session with participants on the clean side (with IXPs) on a private VLAN. A member can redirect a specific prefix or \/24 by advertising that prefix on the NaWas BGP session. NaWas advertises the prefix on our upstreams (transits & peering). So the trigger for redirecting is done manually or automated by the participants.<\/p>

After receiving a prefix or receiving a new DDoS attack on an existing prefix, the NaWas support team receives a notification of the event. The support team checks if the attack is being mitigated well enough and if adjustment is necessary. When the attack is over, the member receives an email with a report on the details of the attack.<\/p>

If an attack lasts longer, NaWas sends an interim report. Participants can view the report on the portal.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDoes NaWas process anything other than \/24s?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

Yes, the internet does not accept subnets smaller than a \/24. However, we are working on an architecture based on a \/32 setup that can be used alongside the \/24.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow does the internet handle more specifics and packet loss?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

In principle, there is no packet loss. Parties that don’t yet know the more specific follow the less specific. Learning the more specific happens very quickly, usually within a few seconds.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow long does it take before no more traffic is visible on one's own transits?<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t

The more parties know the more specific, the more the attack traffic disappears. We assume that clean traffic still passes through. Furthermore, it depends very much on the type of attack to what extent the mitigation systems can immediately reduce the malicious traffic. Most attacks are mitigated immediately. In some cases, it may take a few seconds<\/p>

In some cases, a portion of the attack traffic below a certain threshold may still be allowed through. If that’s the case, the advice is to contact NaWas as soon as possible if the residual traffic causes disruption. After advertising, traffic will route through NaWas within a second, and it may take a few seconds for the entire internet to know the route.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t