Sites, pools and dedicated edges

A site is a location with ZERO-PROTECT edges and the line into it. Every edge runs the same pipeline; setups differ in edges, addresses and who acts above the edge.

What each setup includes: Shared and Dedicated.

Flow export

The edge counts what reaches it; anything dropped before it (router filters, a full uplink, transit filtering) makes that figure fall while the attack continues. A dedicated site exports flow from the routers in front of the edge:

Protocols	sFlow 6343/udp, IPFIX 4739/udp, NetFlow v9 2055/udp
Destination	a collector address from your own pool
Sources	registered exporters only; other exports are dropped silently
Sampling	at most 1:4096

The resulting Upstream figures include what we already dropped. They are sampled, per address and attack class (not per hostname), and never to be added to the edge charts.

Escalation above the edge

When traffic exceeds the line, filtering at the edge no longer helps. The actions a site can use are agreed at setup:

Action	Effect	Service reachable
Local Flowspec	narrow drop rule on the routers before the edge, never on your service ports	yes
Site withdrawal	address no longer announced at this site; other sites serve it	if they have capacity
RTBH	upstream drops everything to the address	no
Divert	announced towards a contracted scrubbing provider that returns clean traffic	yes

• The narrow action comes first. RTBH only takes an address that alone fills the line, and runs automatically only if your agreed policy says so.
• Every action ends after 10 minutes; a persisting or returning attack gets 20, 40, at most 60 minutes.
• A standing filter (always-on Flowspec, needs a Flowspec session with our edges) drops what the edge would drop anyway: unserved ports, reflection traffic, fragments, GRE, ESP, IP-in-IP, excess ICMP. It starts as a dry run.
• With your own transit, the path above your line is your provider's: agree it in advance.

Site setup, exporters and escalation policy: through support.