How to Set up DDoS Detection and Auto-Mitigation on Your Own Servers Using Flowtriq

If you have ever managed a Linux server that has been hit by a DDoS attack, you know the experience well. Traffic spikes out of nowhere, the server starts crawling or goes completely offline, and by the time you figure out what is happening, the damage is done. You are scrambling to look at netstat output, checking if your upstream provider has nullrouted you, maybe trying to push iptables rules while the attack is still hammering your NIC.

The standard advice is to put everything behind Cloudflare or another scrubbing service. That works well for web applications, but it does not help if you are running game servers, APIs over non-HTTP protocols, infrastructure that cannot be proxied, or if someone has already found your origin IP and is hitting it directly.

Flowtriq takes a different approach. Instead of sitting in front of your traffic as a proxy, it runs directly on your server, watches every packet, and handles mitigation from the inside out.

Here is how it actually works.

What Flowtriq Does
At its core, Flowtriq is a detection and response agent. You install it on a Linux server and it starts monitoring your network interface immediately. It checks packets-per-second every single second, compares that against a dynamic baseline it builds from your normal traffic, and the moment something looks wrong it classifies the attack and starts responding.

It can identify eight attack types out of the box: SYN floods, UDP floods, DNS amplification, ICMP floods, HTTP floods, multi-vector attacks, and more. It also does IOC pattern matching against a library of over 65,000 known threat indicators, which means it can identify specific botnets like Mirai variants by their packet signatures, not just by the volume of traffic they produce.

When an attack is detected, Flowtriq works through an escalation policy you define. It might start by deploying a BGP FlowSpec rule to rate-limit the attacking traffic at your router. If the attack is severe enough, it escalates to RTBH blackholing. If it goes beyond what BGP can handle, it automatically triggers cloud scrubbing through Cloudflare Magic Transit, OVH VAC, or Hetzner. The whole process, from detection to first mitigation action, happens in under one second.

While all of this is happening, it fires alerts to wherever your team lives: Slack, Discord, PagerDuty, OpsGenie, SMS, email, or a custom webhook. And it captures a full PCAP of the attack traffic so you have forensic evidence to analyze afterward.

Installing the Agent
Setup takes about two minutes. You need a Linux server and Python installed.

pip install ftagent
sudo ftagent --setup

The setup command walks you through connecting the agent to your Flowtriq workspace using your API key. Once it is running, you will see data appearing in your dashboard within seconds. There is nothing to configure upfront in terms of thresholds because Flowtriq builds a baseline from your real traffic over time and adjusts automatically.
If you have multiple servers, you install the agent on each one and they all report into the same workspace. You can see every node, every incident, and every alert from one place.

What Happens During an Attack
Here is an example of what the agent output looks like during an active attack:

09:44:17  PPS=1,204  BPS=42Mbps   NORMAL
09:44:18  PPS=8,409  BPS=290Mbps  ELEVATED
09:44:19  PPS=47,821 BPS=1.7Gbps  ATTACK DETECTED
09:44:19  Incident opened · UUID: a3f7c2b1
09:44:19  PCAP capture started · IOC: UDP Flood
09:44:20  FlowSpec rule deployed · rate-limit UDP/53
09:44:20  Alert fired · Discord · Slack · PagerDuty
09:48:02  Attack mitigated · 3m43s · PCAP uploaded

The entire sequence from normal traffic to deployed mitigation rule took one second. That is the window that matters. Most DDoS attacks do their worst damage in the first 30 to 60 seconds before anyone even knows an attack is happening.

By the time your monitoring dashboard shows an anomaly, your on-call engineer has been paged, they have pulled up the server, and they have started investigating, Flowtriq has already deployed a mitigation rule and is filtering the attack traffic.

BGP Mitigation vs Cloud Scrubbing
This is where Flowtriq gets interesting for people who run real infrastructure.

Most DDoS protection services work by rerouting all of your traffic through their scrubbing center. Every packet your users send goes to Cloudflare or Akamai first, gets inspected, and then gets forwarded to you. That is fine for websites, but it adds latency and it means your traffic is always going through a third party.

Flowtriq flips this model. Most of the time, your traffic goes directly to your server with no rerouting at all. Flowtriq watches it from the inside. When an attack starts, it pushes BGP FlowSpec rules to your routers to drop or rate-limit the bad traffic at the network edge, before it even reaches your server. Only if the attack is large enough to overwhelm BGP does it escalate to cloud scrubbing.

For the majority of attacks, your legitimate traffic never gets rerouted through anything. The attack traffic gets dropped at the edge. Your users experience nothing.

PCAP Forensics
Every attack generates a full packet capture. Flowtriq starts recording as soon as it detects elevated traffic, which means the PCAP includes the ramp-up phase before the attack fully kicks in. You can download the capture from your dashboard and open it in Wireshark to see exactly what hit you.

This is useful for a few reasons. First, it lets you understand the attack vector in detail, which helps you tune your mitigation policies over time. Second, if you are seeing repeated attacks from the same infrastructure, the PCAP gives you solid evidence to take to your upstream provider or to law enforcement. Third, if you are doing security research or running honeypots, it is genuinely interesting data.

Standard plans keep PCAP files for 7 days. Enterprise plans can retain them for up to 365 days.

Alerting and Integrations
Flowtriq connects to everything. When an attack fires, the alert includes the attack type, peak PPS, peak bandwidth, affected node, and a confidence score if an IOC match was found. The alert goes out within one second of detection.

You can set different escalation policies per severity level. A small UDP flood at 5,000 PPS might just send a Slack message and deploy a rate-limiting rule. A 50 Gbps DNS amplification attack might page your on-call engineer through PagerDuty and immediately trigger cloud scrubbing without waiting for human input.

You can also use webhooks to plug Flowtriq into any custom automation you have built. If you want to automatically open a ticket in your internal system or trigger a runbook in your SOAR platform when an attack is detected, that is straightforward to set up.

Who It Is Built For
Flowtriq is most useful for teams running their own Linux infrastructure rather than relying entirely on managed cloud services. That includes hosting providers who need per-node visibility and automated response across dozens or hundreds of servers, game server operators who get hammered constantly and need sub-second response times, MSPs managing infrastructure for multiple clients, ISPs who need network-level BGP mitigation, and SaaS companies running on bare metal or VPS who cannot afford the latency or cost of routing everything through a scrubbing center.

It is also a solid companion for anyone running security research infrastructure, honeypots, or edge nodes that need to stay online during active targeting.

Pricing
$9.99 per node per month. No per-alert fees, no traffic volume charges, no seat limits. Every node gets unlimited incidents, full PCAP capture, all alert channels, and auto-mitigation. There is a 7-day free trial with no credit card required.

Enterprise pricing is available for 50 or more nodes and includes volume discounts, 365-day PCAP retention, a dedicated Slack channel, and SLA guarantees.

Try It
You can get started at flowtriq.com. The free trial spins up in two minutes and you will see your first attack data immediately if your server is actively being probed, which, if it is internet-facing, it almost certainly is.