Freedom251 › DDoS Protection Software
Andrisoft Wanguard
What Andrisoft Wanguard is
Andrisoft Wanguard is on-premise software for detecting DDoS attacks, monitoring network traffic, and supporting mitigation. Its anomaly engine checks more than 150 metrics against thresholds and learned baselines. Flow Sensors accept NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX; Packet Sensors inspect mirrored or in-line traffic. Mitigation options include BGP Flowspec, RTBH, Linux filtering servers, and third-party scrubbing services or appliances. Response actions can run scripts, while alerts can go by email, syslog, or SNMP. Components install as Linux packages on customer servers, and the maker says traffic need not leave the network. The free web Console supports unlimited users and managed components, multi-tenant views, and a REST API. Supported 64-bit x86 systems include RHEL, Rocky, and AlmaLinux 9–10, Debian 11–13, and Ubuntu Server 20–26. A Sensor license costs $595 per year; a Filter license costs $995 per year, with a Sensor license sold separately for Filter use. A requested trial key enables all features on any number of servers for 30 days.
Who it suits
Wanguard suits network and security operations centers seeking on-premise traffic monitoring and DDoS detection and mitigation. Its Linux components run on customer servers.
What it does well
- Analyzes more than 150 traffic metrics.
- Supports multiple flow formats and packet inspection.
- Offers several mitigation methods and scriptable responses.
- Free Console supports unlimited users and managed components.
- 30-day trial key enables all features.
What to know first
- Filter license requires a Sensor license separately.
- Slow, low-volume HTTP attacks are outside Wanguard Filter’s scope.
- Supported systems are listed for 64-bit x86 Linux.
- Standard support is limited to weekdays.
Limits
The free Console has unlimited users and managed components, but Sensor and Filter capabilities require their respective licenses. Wanguard Filter is intended for volumetric and protocol floods; slow, low-volume HTTP attacks are outside its scope.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Wanguard Sensor license | 1 year · One Packet Sensor or one Flow Sensor · one Flow Sensor per exporter · Sensor clusters and Console need no license | $595 a year |
| Wanguard Filter license | 1 year · One Packet Filter or one Flow Filter · Packet Filter covers one network interface · Sensor license sold separately | $995 a year |
As andrisoft.com lists them, read 5 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Andrisoft website
- Choose a Sensor or Filter license
- Request the 30-day trial key if desired
- Install Linux packages on supported customer servers
- Configure Flow Sensors or Packet Sensors
- Connect mitigation methods and alert channels
- Access the web Console
Verdict
Wanguard combines network traffic monitoring with several mitigation paths and an on-premise deployment model. Its stated scope excludes slow, low-volume HTTP attacks, for which the maker recommends a WAF or IPS behind it.
Questions
How much does Wanguard cost?
The Sensor license costs $595 a year. The Filter license costs $995 a year, with a Sensor license sold separately for Filter use.
Is there a free plan or trial?
There is no free product license, but the web Console is free. A requested trial key enables all features for 30 days on any number of servers.
Which systems are supported?
Supported 64-bit x86 systems include RHEL, Rocky, and AlmaLinux 9–10, Debian 11–13, and Ubuntu Server 20–26.
What traffic sources can Wanguard inspect?
Flow Sensors support NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX. Packet Sensors inspect mirrored or in-line traffic.
Does Wanguard include a WAF?
No. The maker says slow, low-volume HTTP attacks are outside Wanguard Filter’s scope and recommends a WAF or IPS behind it.
What support is included?
Standard email and portal support is included with every license on weekdays. Enterprise Support offers a guaranteed one-hour response 24/7/365.
Facts from Andrisoft Wanguard's own pages
- Automation and alerts
- Response actions can run scripts, and alerts can be sent by email, syslog, or SNMP. · andrisoft.com, 5 Oct 2026
- Console
- The web Console is free, supports unlimited users and managed components, and provides multi-tenant views and a REST API. · andrisoft.com, 5 Oct 2026
- Deployment
- Components are Linux packages installed on the customer's own servers, and the maker says traffic need not leave the network. · andrisoft.com, 5 Oct 2026
- Detection
- Its anomaly engine checks more than 150 metrics against thresholds and learned baselines to detect traffic anomalies and DDoS attacks. · andrisoft.com, 5 Oct 2026
- Founded
- 2006 · andrisoft.com, 28 Sept 2026
- Headquarters
- Timisoara, Romania · andrisoft.com, 28 Sept 2026
- Intended users
- Andrisoft describes its software as built for network and security operations centers and says it serves more than 1,000 network operators in over 50 countries. · andrisoft.com, 5 Oct 2026
- Mitigation
- Wanguard can mitigate with BGP Flowspec, RTBH, Linux filtering servers, or third-party scrubbing services and appliances. · andrisoft.com, 5 Oct 2026
- Product limit
- Wanguard Filter is designed for volumetric and protocol floods; the maker says slow, low-volume HTTP attacks are outside its scope and recommends a WAF or IPS behind it. · andrisoft.com, 5 Oct 2026
- Purpose
- Wanguard is on-premise software for DDoS detection and mitigation, traffic monitoring, and analytics. · andrisoft.com, 5 Oct 2026
- Support
- Standard email and portal support is included with every license on weekdays, while Enterprise Support offers a guaranteed one-hour response 24/7/365. · andrisoft.com, 5 Oct 2026
- Supported systems
- The product page lists 64-bit x86 support for RHEL, Rocky, and AlmaLinux 9–10, Debian 11–13, and Ubuntu Server 20–26. · andrisoft.com, 5 Oct 2026
- Traffic inputs
- Flow Sensors support NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX, while Packet Sensors inspect mirrored or in-line traffic. · andrisoft.com, 5 Oct 2026
- Trial
- A requested trial key activates all features on any number of servers for 30 days, with review and download links emailed within up to 24 hours. · andrisoft.com, 5 Oct 2026
Where Andrisoft Wanguard stands on Freedom251
- DDoS Protection Software#7 of 37