Eleven Feature Switches — What Each One Actually Buys You
features
experience features
whole security posture
you evaluate in observe
Two jobs, not one
It is worth separating the eleven before comparing them, because the two halves are bought for completely different reasons and are justified to a board in completely different language.
One half defends the network. The other half defends the customer relationship.
Five security features
Keep attack traffic out, and stop your own subscribers being used to attack others. Measured in outages avoided, abuse tickets, and whether your address space stays trusted.
Six experience features
Add no capacity. They change how traffic is queued and dropped. Measured in support calls, churn, and what a subscriber says when asked if their internet is fast.
Most “my internet is slow” complaints arrive on lines that still have capacity to spare. That is a queueing problem, and bandwidth does not fix it.
Group 1 · Security — keeping bad traffic out
Inbound attack protection
Scores six attack types separately rather than simply counting packets: UDP reflection and amplification, TCP SYN floods, ICMP floods, general UDP floods, out-of-state TCP, and everything else. Each has both a per-subscriber and a network-wide threshold.
When the network-wide figure is exceeded it recognises a carpet attack — many subscribers hit at once — and tightens every victim's individual threshold automatically.
A solicited gate means traffic arriving on a connection the subscriber themselves just opened is not counted against them, so a customer's own large download cannot be read as an attack. Reflection traffic never receives that exemption.
Coordinated security posture
Not another filter. A single coordinator with three states — off, monitor, enforce — at low, normal or high intensity. It derives the inbound DDoS mode and the outbound scanner and quarantine settings from that one setting.
monitor is the safe first step: full telemetry everywhere, zero packets dropped, so you can see exactly what enforcement would have done to real subscriber traffic before you commit to it.
Source address validation
Drops packets whose source address is not the one actually assigned to that subscriber, and records the top forged IPv4 sources and IPv6 /64 sources so you can see who is attempting it.
This is the difference between being a victim and being a source. Without it, one infected subscriber can emit spoofed packets that make your address space the apparent origin of an attack on somebody else.
Group 2 · Security — abuse that starts inside your network
Infected subscriber equipment is the normal case, not the rare one. These two find it and contain it without an engineer, and usually without a support call.
Outbound scanner and botnet fan-out detection
Flags a subscriber scanning the internet: a high connection-attempt rate spread across many destinations, sustained long enough to rule out an ordinary burst.
This deliberately looks for what volumetric detection cannot see — a small amount of traffic aimed at a very large number of destinations. Measured in bandwidth, it is invisible.
Automatic containment, with automatic release
Identifies chronic abusers — sustained blocked traffic, or a persistently high threat score — and places them in a hold that releases itself once behaviour returns to normal. The scanner detector can feed straight into it.
A subscriber whose malware was throttled for a few minutes rarely notices. The realistic alternatives are to ignore the abuse, or to disconnect a paying customer by hand.
Group 3 · Experience — making the same line feel faster
None of these four add bandwidth. They change how traffic is queued and dropped, and that is what a subscriber actually perceives as speed.
Active Queue Management
Stops the queue filling with buffered data, and where traffic supports ECN it marks packets instead of dropping them. Runs in classic, L4S or dual-queue mode, with a control loop that adapts continuously.
Without queue management, one large download fills the buffer and every other application in that home — video calls, gaming, web pages, voice — waits behind it. The line has not run out of capacity; the packets are simply sitting in a queue.
Interactive Flow Protection
Gives priority to the packets that carry control rather than data: pure TCP acknowledgements, the SYN packets that open connections, and DNS queries.
When a line saturates, the packets lost are whichever arrive at the wrong moment — and the tiny ones matter most. Lose an acknowledgement and the download it belongs to stalls. Lose a DNS query and the subscriber reports that the internet is down while the line runs at full speed. Lose a SYN and the page never starts loading at all.
Approximate Fair Dropping
Measures each subscriber's average per-connection rate and drops proportionally more from the connections taking more than their fair share.
You get this without configuring anything per application, and without needing to identify the applications — which matters now that almost all traffic is encrypted.
Flow Isolation
Identifies elephant flows — bulk transfers, judged by both cumulative bytes and sustained rate — and keeps them clear of latency-sensitive traffic, demoting them when that subscriber's queue delay starts to rise. It measures real loss to make the decision rather than guessing.
Group 4 · Experience — measuring it, and tuning itself
You cannot improve what you cannot see, and you should not have to tune every site by hand.
Quality of Experience measurement
Measures round-trip time from the TCP handshake itself, per subscriber and per interface, taken from live subscriber traffic rather than from a synthetic test.
Autonomous Experience Controller
Scores every subscriber from 0 to 100 — a Subscriber Experience Score — weighted across latency (the largest component), stability under spikes, and loss. It diagnoses which of the three is the problem, and in enforce mode retunes the queue-management target automatically to correct it.
All eleven on one page
| Feature | Half | What it does | What you get |
|---|---|---|---|
ddos | Security | Drops inbound attacks by type, at line rate | One subscriber under attack stops degrading everyone else |
protect | Security | One switch governing every other security feature | A single posture to set and audit |
antispoof | Security | Blocks forged source addresses | Your ranges never become the source of an attack |
scanner | Security | Detects subscribers scanning the internet | Infected equipment found before abuse reports arrive |
quarantine | Security | Holds chronic abusers, releases automatically | Abuse stops without disconnecting a paying customer |
aqm | Experience | Keeps queues short, marks instead of dropping | Low latency under load — the largest perceived gain |
ifp | Experience | Prioritises acknowledgements, SYNs and DNS | Pages keep loading and downloads do not stall |
afd | Experience | Fair dropping between connections | One application cannot starve a household |
fi | Experience | Isolates bulk flows from interactive ones | Streaming and backups stop ruining video calls |
qoe | Experience | Measures real latency from live traffic | Evidence instead of opinion in support |
aec | Experience | Scores experience and auto-tunes the queue | Self-tuning, plus one number per subscriber |
How to switch these on safely
The order matters less than the mode. Every feature here has an observe or monitor state that measures fully and drops nothing.
- Start in monitor. Full telemetry across the inbound and outbound security features, with zero risk to subscriber traffic.
- Read the telemetry for a few days. Look at what would have been blocked or quarantined. Real networks always hold surprises — a legitimate service that looks like a scanner, a subscriber whose ordinary traffic trips a threshold.
- Tune the thresholds to your own traffic, then enforce. The defaults are sensible starting points, not answers; your subscriber mix decides the right numbers.
- Bring the experience features up separately. Queue management first, since it delivers most of the perceived improvement on its own, then the flow-level features. These carry less risk, because they change how traffic is queued rather than deciding what to discard.
- Leave the measurement features on from the start. They cost nothing, and they are how you prove the rest of it worked.
The one-line version
Five features protect the network. Six make the bandwidth you already sell feel faster. All eleven can be evaluated in observe mode, on your own traffic, before a single packet is dropped.
This page is an orientation guide. Each feature has its own brochure with the engineering detail, the measured data where measurements exist, and the limits of what is claimed.