Question 1

What types of DDoS attacks do you mitigate?

Accepted Answer

We cover the main vectors at L3 (network) and L4 (transport): SYN flood, UDP flood, ICMP flood, amplification (DNS, NTP, memcached, SSDP), reflection, fragmentation, spoofed IP, ACK flood and TCP reflect. Profiles are applied per application (gaming UDP, voice/VoIP, web, infra, VPN). In Madrid the catalog is extended with 40+ filters manageable from the panel.

Question 2

Do you cover L7 (HTTP flood, Slowloris)? If not, why?

Accepted Answer

No, we cover L3/L4 only. L7 attacks (HTTP flood, Slowloris, bots, scraping) are mitigated server-side: with a WAF, a CDN like Cloudflare in front, or rules in your own nginx/HAProxy. We focus on what happens before the packet reaches your server (network and transport). If you need full L7 coverage, combine it with a WAF/CDN layer on top.

Question 3

What's the real scrubbing capacity per datacenter?

Accepted Answer

Madrid: our own Hostealo Shield with +200 Gbps capacity. Eygelshoven (NL): PletX with +1 Tbps. Mainhausen (DE): W&D Shield + PletX with +1 Tbps. New York: Basic Anti-DDoS (no specific figure published). Capacities are per DC, not theoretical sums: each datacenter has its own scrubbing infrastructure.

Question 4

How long does it take to detect and mitigate an attack?

Accepted Answer

Automatic detection in under 1 second. The system analyses traffic continuously, detects the attack pattern and applies the right per-application filter without human intervention. Mitigation is always-on, you don't have to activate anything when the attack arrives — it's already in place from the first packet.

Question 5

Do I need to configure anything or is it automatic?

Accepted Answer

Per-application profiles are applied automatically via auto-discovery: the system detects the traffic type (gaming, web, voice, VPN, etc.) and applies the corresponding filter without you touching anything. A first human review of your profile is always recommended and we coordinate it by ticket. If you contract IP Transit with GRE or BGP, the tunnel config and announcements from your side are on you.

Question 6

Does it work for game servers (Minecraft, CS2, Rust, Source engine)?

Accepted Answer

Yes. We have XDP profiles specific to gaming. We cover the typical game-server protocols (custom UDP, Source engine, Steam protocol, Minecraft, RakNet, etc.) with filters that validate the protocol handshake and drop illegitimate traffic before reaching the server's port. That's why a game server on Hostealo stays up and lag-free under sustained floods.

Question 7

Are there false positives? How are they handled?

Accepted Answer

They can happen (typical noise in any serious scrubbing system). If the system blocks legitimate traffic, tell us by ticket: our part of the scrubbing records the PCAP of the affected traffic and we analyse it with you to understand the pattern and adjust the rule. It's not a black box, we can see and change whatever's needed.

Question 8

Do I have attack visibility? Is there a dashboard, API or AI integration?

Accepted Answer

Yes, several options. Client panel with real-time attack visualisation, detected vectors and applied rules. REST API for direct management (add rules, query attacks, export logs). Built-in AI assistant in the panel that analyses attacks and suggests automatic profile adjustments. And an MCP server you can connect to ChatGPT, Claude or another LLM to manage Anti-DDoS from your own AI conversation.

Question 9

Is it included at no cost or is there a paid tier?

Accepted Answer

L3/L4 Anti-DDoS is included at no cost on Hostealo VPS, dedicated servers and colocation. No franchise, no hidden add-ons, no paid tier. The only thing billed separately is IP Transit with Anti-DDoS: for external networks (not hosted at Hostealo) or services under constant attack that need reserved scrubbing capacity above what's included.

Question 10

What is 'IP Transit with Anti-DDoS' and how much does it cost?

Accepted Answer

Service focused on customers with their own external network (their /24 IPv4 and ASN) who want to protect their traffic behind our scrubbing. Connection to our stack is via GRE, direct tunnel or BGP depending on the case. Price depends on traffic volume, reserved scrubbing capacity and connection model, so it's quoted case by case. Contact us for a concrete proposal.

Question 11

Does it work to protect servers NOT hosted at Hostealo?

Accepted Answer

Yes, through IP Transit with Anti-DDoS. Your /24 is announced behind our AS, traffic enters through our scrubbing and exits clean toward your origin, which can live in any datacenter (another provider, your own on-prem, multi-cloud, etc.). The connection from us to your origin is via GRE or BGP tunnel as you prefer.

Question 12

What can I do in the Madrid advanced panel that I can't in other DCs?

Accepted Answer

The Madrid advanced panel (only available on Hostealo Shield, our in-house system) adds: per-IP rule definition, blocking by ASN or country, creation of custom XDP filters for specific cases and maintenance of IP lists (whitelist, blacklist). In the other DCs scrubbing is automatic without these advanced options, because mitigation is operated by the DC provider (PletX or W&D).

Anti-DDoS mitigation with auto-discovery

Auto-discovery in all DCs

Filter catalog per datacenter

Madrid

Eygelshoven

Mainhausen

Advanced panel. Hostealo Shield

Per-IP rules

Custom filters

ASN or country block/whitelist

IP lists

IP Transit with Anti-DDoS

What's included (and what isn't)

Included at no cost

Not included

Frequently asked questions

L3/L4 Anti-DDoS included, no tickets, no extras