Skip to content
SPECIFICTION
Get listed

Andrisoft Wanguard

andrisoft.com

From $49.58/mo Free trial WebLinuxAPISelf-hosted
Visit andrisoft.com
Spec score 8.5 #1 of 37 in DDoS Protection Software

What it is

Andrisoft Wanguard is on-premise software for detecting and mitigating DDoS attacks, monitoring traffic, and analyzing network activity. Its anomaly engine checks more than 150 metrics against thresholds and learned baselines. Flow Sensors accept NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX, while Packet Sensors inspect mirrored or in-line traffic. Mitigation options include BGP Flowspec, RTBH, Linux filtering servers, and third-party scrubbing services or appliances. Response actions can run scripts, and alerts can go by email, syslog, or SNMP. Components are Linux packages installed on a customer’s own servers; the maker says traffic need not leave the network. The web Console is free, supports unlimited users and managed components, and includes multi-tenant views and a REST API. A Sensor license costs $595 a year; a Filter license costs $995 a year, and Filter use requires a separately sold Sensor license. A requested trial key enables all features on any number of servers for 30 days.

Spec sheet

Purpose
Wanguard is on-premise software for DDoS detection and mitigation, traffic monitoring, and analytics.Read 5 Oct 2026 · andrisoft.com
Intended users
Andrisoft describes its software as built for network and security operations centers and says it serves more than 1,000 network operators in over 50 countries.Read 5 Oct 2026 · andrisoft.com
Deployment
Components are Linux packages installed on the customer's own servers, and the maker says traffic need not leave the network.Read 5 Oct 2026 · andrisoft.com
Trial
A requested trial key activates all features on any number of servers for 30 days, with review and download links emailed within up to 24 hours.Read 5 Oct 2026 · andrisoft.com
Support
Standard email and portal support is included with every license on weekdays, while Enterprise Support offers a guaranteed one-hour response 24/7/365.Read 5 Oct 2026 · andrisoft.com
Headquarters
Timisoara, RomaniaRead 28 Sep 2026 · andrisoft.com
Founded
2006Read 28 Sep 2026 · andrisoft.com
Automation and alerts
Response actions can run scripts, and alerts can be sent by email, syslog, or SNMP.Read 5 Oct 2026 · andrisoft.com
Console
The web Console is free, supports unlimited users and managed components, and provides multi-tenant views and a REST API.Read 5 Oct 2026 · andrisoft.com
Detection
Its anomaly engine checks more than 150 metrics against thresholds and learned baselines to detect traffic anomalies and DDoS attacks.Read 5 Oct 2026 · andrisoft.com
Mitigation
Wanguard can mitigate with BGP Flowspec, RTBH, Linux filtering servers, or third-party scrubbing services and appliances.Read 5 Oct 2026 · andrisoft.com
Product limit
Wanguard Filter is designed for volumetric and protocol floods; the maker says slow, low-volume HTTP attacks are outside its scope and recommends a WAF or IPS behind it.Read 5 Oct 2026 · andrisoft.com
Supported systems
The product page lists 64-bit x86 support for RHEL, Rocky, and AlmaLinux 9–10, Debian 11–13, and Ubuntu Server 20–26.Read 5 Oct 2026 · andrisoft.com
Traffic inputs
Flow Sensors support NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX, while Packet Sensors inspect mirrored or in-line traffic.Read 5 Oct 2026 · andrisoft.com

Plans and prices

Wanguard Sensor license $595 a year 1 year One Packet Sensor or one Flow Sensor · one Flow Sensor per exporter · Sensor clusters and Console need no license Read 5 Oct 2026 · andrisoft.com
Wanguard Filter license $995 a year 1 year One Packet Filter or one Flow Filter · Packet Filter covers one network interface · Sensor license sold separately Read 5 Oct 2026 · andrisoft.com

Every Andrisoft Wanguard plan and price →

Strong points and limits

Strong points

  • Checks more than 150 metrics for anomalies
  • Supports flow and packet traffic inputs
  • Multiple mitigation methods, including BGP Flowspec
  • Free Console with unlimited users and components
  • 30-day trial key covers all features

Limits

  • Slow, low-volume HTTP attacks are outside Filter’s scope
  • Filter license requires a separate Sensor license
  • WAF is not included
  • Standard support is limited to weekdays

Who it suits

Wanguard is intended for network and security operations centers that want on-premise detection and mitigation. Its stated operating-system support and traffic sources are relevant to teams managing Linux-based network infrastructure.

Verdict

Wanguard combines traffic monitoring, anomaly detection, and several mitigation approaches, with deployment on customer servers. Check the Filter scope and license requirements against the attacks and infrastructure you need to cover.

Where Specifiction places it

Alternatives to Andrisoft WanguardAll alternatives →