Global anycast network

How traffic reaches your services on Coritan's anycast network: 1.4+ Tbps of network capacity, Tier-1 transit providers at every location and DDoS filtering where traffic enters.

We run our own network and connect it to the internet at points of presence. Traffic to your floating IPs enters at the nearest one, passes DDoS Shield there and goes on to the machine your service runs on.

Order a floating IP · Talk to sales

• 1.4+ Tbps of network capacity
• Under 5 ms to major population centres in every region we serve
• Tier-1 transit providers at every location
• AS401824 our own network

Coverage and routing

Our network meets the internet at points of presence and announces its addresses there over BGP, the protocol networks use to tell each other which addresses they carry.

• Points of presence. A point of presence (PoP) is a site where our routers connect to the internet. It announces our address ranges, filters the traffic it receives and passes the rest on to the machine your service runs on. Under 5 ms to major population centres in every region we serve.
• Anycast addresses. Anycast means announcing one address range from more than one PoP. The internet delivers each packet to the PoP its routing finds nearest, so traffic enters our network close to where it was sent from. Our platform addresses and our eight nameservers, ns1.coritan.com to ns8.coritan.com, are anycast. How the Coritan network works
• Floating IP ranges over BGP. We announce the ranges your floating IPs come from at our PoPs over BGP. Traffic to a floating IP enters at a PoP that announces it, usually the one nearest the sender. A floating IP comes from a pool in one region. When you move it to another instance or server, its traffic follows. See Floating IPs
• The way back out. Traffic your instance or server sends from a floating IP, replies included, leaves through the Coritan router nearest its machine, one in the same location when there is one. If the machine cannot reach a router, that traffic stops until it can. It never leaves by another route.
• Tier-1 transit. Tier-1 transit providers at every location. A Tier-1 network reaches every other network on the internet without buying transit from another. 1.4+ Tbps of network capacity.
• Route validation. RPKI route validation on every BGP session. Our routers check each route they learn against the public record of which network may announce it, and refuse a route that fails. Our own network is AS401824.

From the PoP to your machine

Filtered traffic travels on our own network from the PoP where it entered to the machine your service runs on.

1. It enters near the sender. The internet delivers a packet for a floating IP to the PoP its routing finds nearest.
2. DDoS Shield filters it. Packet checks, rate limits and your rules run at the PoP, with the settings of that floating IP.
3. Our network carries it to your machine. What passes goes on over our network to the machine that runs the instance or server the address is attached to.

Uptime

No plan you buy in the dashboard includes an uptime percentage. An Enterprise agreement can set one. The SLA page says what we commit to about availability and how to make a claim.

Read the SLA

Protection by layer

Each kind of traffic has its own filter, and each filter comes with a product.

DDoS Shield

Included. Filters network and transport traffic, layers 3 and 4, to every floating IP at all times. Three stages run in order: packet checks, four rate limits and your rules. Under 3 seconds to detect an attack. Each rate limit allows bursts of up to twice its rate.

See DDoS Shield

Game Shield

Included. A TCP proxy for game joins. Players connect to a join address on our edge, which limits the connections from each player’s address and passes the rest to your server. For Minecraft Java it also checks each handshake and turns away first joins during a flood.

See Game Shield

Edge Proxy

Included. A web application firewall (WAF) for HTTP and HTTPS. It checks each request before it reaches your origin, and blocks a request that looks like an attack or asks the visitor to prove they are human. It answers 429 to a client that sends too many requests.

See Edge Proxy

Technical specifications

Routing

• Routing protocol: BGP
• Anycast: Platform addresses and nameservers ns1 to ns8
• Network: AS401824, our own network
• Route validation: RPKI route validation on every BGP session

Capacity and transit

• Network capacity: 1.4+ Tbps
• Transit: Tier-1 transit providers at every location
• Latency: Under 5 ms to major population centres in every region we serve

Addresses and filtering

• Address family: IPv4 for every address you order in the dashboard
• DDoS filtering: Always on for floating IPs
• Attack detection: Under 3 seconds
• Shared addresses: Not filtered by DDoS Shield

Through sales

• Custom connectivity: Customer BGP, bring your own IP, private peering and cross-connects

Service levels

• Service level agreement: Set in an Enterprise agreement

Custom connectivity

Our sales team sets up BGP sessions, announces your own address space, and arranges private peering, cross-connects and IP transit.

To announce your own range, you bring your prefixes and a letter of authority that lets us announce them.

Talk to sales

Use cases

Keep a game server up during a flood

Attach a floating IP to the server so its traffic enters at a PoP and passes DDoS Shield. Give players a join address, and the edge checks each connection before your server sees it.

Uses App Deployment, a floating IP and Game Shield

Protect a game server

Move a service and keep its address

Attach the floating IP to the new instance or server, and its traffic and its DDoS Shield settings follow. Players and DNS records keep the same address.

Uses Cloud Compute and a floating IP

Attach and detach a floating IP

Put a website behind the WAF

Point your domain at a web proxy. Each request then reaches our edge first, where the WAF checks it before it goes on to your origin.

Uses Edge Proxy and DNS

Protect a website with the WAF

Announce your own address space

Bring your prefixes and a letter of authority that lets us announce them. Our sales team sets up a BGP session for your own network number, or announces them from ours.

Uses Your own IP and BGP, through sales

Bare metal, colocation and IP transit

Limits

• Floating IPs come as IPv4 or IPv6 addresses. An instance in a location with IPv6 also gets a /64 of its own.
• DDoS Shield filters traffic to floating IPs. Traffic to a server’s shared address goes to its machine directly.
• DDoS Shield does not filter the traffic your service sends.
• A floating IP comes from a pool in one region, so choose one in the region where its instance or server runs.
• The dashboard has no page for BGP sessions, peering or cross-connects. Our sales team sets them up.

Network limits in the docs

Guides for the network

Each guide in our docs explains one part of how traffic reaches your services.

• How the Coritan network works: Points of presence, anycast, the way traffic leaves, and why the addresses you order are IPv4.
• How DDoS Shield works: The three stages, the four rate limits and the protection modes.
• TCP proxy protection: What the edge checks for web proxies, join addresses and TCP services.
• IP pools and regions: Where each floating IP comes from, and how to choose a pool.
• Data centres and locations: The locations where we have servers, which products have room in each, and how to choose a location when you order.
• Bare metal, colocation and IP transit: What our sales team sells, and how buying through sales works.

Put your service on our network

Your account starts on the Free plan. Attach a floating IP to a server to put its traffic behind DDoS Shield.

Order a floating IP · Start free