Andrisoft Wanguard
Andrisoft Wanguard is on-premise software for DDoS detection and mitigation, traffic monitoring, and analytics.
What Andrisoft Wanguard is
Andrisoft Wanguard is on-premise software for DDoS detection and mitigation, traffic monitoring, and analytics. Its anomaly engine checks more than 150 metrics against thresholds and learned baselines. Flow Sensors accept NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX, while Packet Sensors inspect mirrored or in-line traffic. Mitigation options include BGP Flowspec, RTBH, Linux filtering servers, and third-party scrubbing services or appliances. Components are Linux packages installed on customer servers, and the maker says traffic does not need to leave the network. The free web Console supports unlimited users and managed components, multi-tenant views, and a REST API. Response actions can run scripts, with alerts sent by email, syslog, or SNMP. Wanguard Filter is designed for volumetric and protocol floods; the maker says slow, low-volume HTTP attacks are outside its scope and recommends a WAF or IPS behind it. A requested trial key enables all features for 30 days.
Good
- Checks more than 150 metrics for anomalies
- Supports multiple flow data formats
- Offers several mitigation methods
- Free web Console includes a REST API
Watch out
- Slow, low-volume HTTP attacks are outside Filter's scope
- Filter use requires a separate Sensor license
- Standard support is weekdays only
Who it suits
Wanguard is aimed at network and security operations centers that need on-premise traffic monitoring and DDoS mitigation. It may suit teams that can deploy Linux components on their own servers.
Verdict
Wanguard combines anomaly detection, traffic monitoring, and mitigation options in a self-hosted deployment. Its stated scope excludes slow, low-volume HTTP attacks, and Filter use has separate Sensor licensing requirements.
Plans and prices
From Andrisoft Wanguard's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Wanguard Sensor license | $595 a year | One Packet Sensor or one Flow Sensor · one Flow Sensor per exporter · Sensor clusters and Console need no license · 1 year |
| Wanguard Filter license | $995 a year | One Packet Filter or one Flow Filter · Packet Filter covers one network interface · Sensor license sold separately · 1 year |
The facts
Each one read from Andrisoft Wanguard's own pages, with the date it was checked.
What it does
- Automation and alerts
- Response actions can run scripts, and alerts can be sent by email, syslog, or SNMP.checked 5 Oct 2026
- Console
- The web Console is free, supports unlimited users and managed components, and provides multi-tenant views and a REST API.checked 5 Oct 2026
- Deployment
- Components are Linux packages installed on the customer's own servers, and the maker says traffic need not leave the network.checked 5 Oct 2026
- Detection
- Its anomaly engine checks more than 150 metrics against thresholds and learned baselines to detect traffic anomalies and DDoS attacks.checked 5 Oct 2026
- Intended users
- Andrisoft describes its software as built for network and security operations centers and says it serves more than 1,000 network operators in over 50 countries.checked 5 Oct 2026
- Mitigation
- Wanguard can mitigate with BGP Flowspec, RTBH, Linux filtering servers, or third-party scrubbing services and appliances.checked 5 Oct 2026
- Product limit
- Wanguard Filter is designed for volumetric and protocol floods; the maker says slow, low-volume HTTP attacks are outside its scope and recommends a WAF or IPS behind it.checked 5 Oct 2026
- Purpose
- Wanguard is on-premise software for DDoS detection and mitigation, traffic monitoring, and analytics.checked 5 Oct 2026
- Support
- Standard email and portal support is included with every license on weekdays, while Enterprise Support offers a guaranteed one-hour response 24/7/365.checked 5 Oct 2026
- Supported systems
- The product page lists 64-bit x86 support for RHEL, Rocky, and AlmaLinux 9–10, Debian 11–13, and Ubuntu Server 20–26.checked 5 Oct 2026
- Traffic inputs
- Flow Sensors support NetFlow, jFlow, cflowd, NetStream, sFlow, and IPFIX, while Packet Sensors inspect mirrored or in-line traffic.checked 5 Oct 2026
The company
- Founded
- 2006checked 28 Sep 2026
- Headquarters
- Timisoara, Romaniachecked 28 Sep 2026
Money
- Trial
- A requested trial key activates all features on any number of servers for 30 days, with review and download links emailed within up to 24 hours.checked 5 Oct 2026
Alternatives to Andrisoft Wanguard
- 1
Oracle Cloud Infrastructure Secret Management
Free planWebAPI7.0Free plan - 2
Haltdos
Free planWebAPILinuxSelf-hosted6.8From $30 a month - 3
FastNetMon
WebAPILinuxmacOS6.7From $115 a month - 4
Gcore DDoS Protection
Free planWebAPI6.7Free plan - 5
AWS Shield
Free planWebAPI6.5From $3,000 a month - 6
Imperva API Security
WebAPISelf-hosted6.5