HARPP DDoS Mitigator: Architecture, Capabilities and Trade-offs

Best for:

multi-tenant providers, and estates with a data-residency or evidence-custody requirement

Four properties are asserted here because a buyer can confirm each directly; the rest describes what the manufacturer’s documentation establishes. That documentation is not yet published, which is a real weakness of this page rather than a formality — read the Sources note before using it in an evaluation.

At a glance

Appliance	Value	Evidence
Manufacturer	Labris Networks	Vendor-stated
Category	On-premises appliance	Vendor-stated
Deployment	Inline, as a transparent bridge or as a gateway	Vendor-stated
Detection location	Customer's own infrastructure; no vendor intelligence cloud dependency	Vendor-stated, verifiable on a test bench
Layer coverage	L3–L7 in a single appliance	Vendor-stated, verifiable on a test bench
Multi-tenancy	Per-customer protection profiles on shared hardware	Vendor-stated, verifiable on a test bench
Own global scrubbing cloud	No	Vendor-stated
Published capacity figures	200 Gbps, 80–90 Mpps for a single appliance	Vendor-stated, not independently tested
Best-fit environment	Multi-tenant providers and estates with a residency or evidence-custody requirement	Editorial inference

Architecture

An inline on-premises appliance. The architectural property that distinguishes it from a decomposed design is that Layer 3 through Layer 7 coverage lives in a single unit vendor-stated, rather than an edge appliance handling the network layers and a separate component handling the application layer.

Whether that helps depends on the estate: it removes an integration and puts more of the defence behind one failure domain, a trade the multi-vendor architecture assessment works through properly.

Detection and classification

Detection runs entirely on the customer’s own infrastructure, with no dependency on a vendor-operated intelligence cloud vendor-stated.

The test is simple and settles the question for any product: disconnect the appliance’s outbound path to the manufacturer, repeat the same attack, compare the two runs. Local classification degrades gracefully on novel vectors; a dependency on an external service degrades in a step. Two documented details support the claim structurally — heuristic signatures ship with the appliance, and the geographic database is a versioned package installed on it rather than a lookup service.

Layer 3 and Layer 4 mitigation

Covered in the same unit as the application layer vendor-stated. SYN flood protection runs in a symmetric or asymmetric mode chosen to match whether the device sees both directions of traffic, with a configurable handshake window; malformed-packet handling, protocol blocking, rate limits and country rules sit alongside it. Behaviour under packet-rate stress should still be measured at 64-byte packet sizes rather than inferred from a bit-rate figure.

Layer 7 mitigation

Covered in the same unit vendor-stated. The documented DNS work is specific enough to name: query-rate limits per source, random-subdomain and NXDOMAIN detection, a novel-name mode for topologies where responses are not visible, and a per-domain aggregate ceiling. Depth relative to purpose-built application-layer designs is what a proof of concept with replayed application traffic exists to measure.

Capacity and packet-rate considerations

The manufacturer publishes 200 Gbps of mitigation throughput and 80–90 million packets per second for a single appliance vendor-stated. Untested independently, and not a design input: a family-level figure describes the largest model, not the unit quoted. One trap will catch anyone who checks — the figures still on the manufacturer’s public website belong to an earlier hardware generation and are several times lower. Establish which generation a quotation covers.

Multi-tenancy

Per-customer protection profiles on shared hardware vendor-stated. For a provider selling protection as a service this decides whether the product is usable at all, and it is verifiable: configure two tenants with different policies, attack one, confirm isolation and per-customer reporting.

HA, bypass and failure modes

A hardware bypass exists and its state is reported on the dashboard vendor-stated. Establish the behaviour on power loss and on software fault, and the measured failover time — the same questions asked of every inline appliance on this site, and the ones a status indicator does not answer.

Management and telemetry

Telemetry stays on infrastructure the customer controls, which is the consequence of local detection. Syslog and SNMP export are documented, alongside per-zone and per-rule traffic statistics, top-talker views, an alarm record that doubles as the incident log, and packet capture that shows the pass or drop decision taken for each packet vendor-stated. Retention behaviour and report formats should be established against the quoted configuration.

Data and control-plane dependencies

None stated for classification vendor-stated. Licensing, updates, support and hardware replacement still depend on a live commercial relationship — true of every manufacturer here, and removed by no architectural choice.

Integrations

Syslog and SNMP for telemetry, RADIUS for administrator authentication vendor-stated. Whether that is enough depends on what the receiving side expects: a syslog stream is not the same thing as a maintained connector, and the parsing work lands on the buyer.

Regional support

Not publicly documented here. Support scale is a genuine difference between a multinational and a smaller manufacturer, and the question is the same one asked of everyone: who answers at 3am local time, in which language, under what response commitment.

Licensing and TCO characteristics

The commercial relationship is separate from the upstream or transit tier vendor-stated, so the on-premises decision does not commit the transit decision and either can be renegotiated without the other. A commercial property, not a technical one: it changes what you can renegotiate, not what either tier can absorb. Licensing structure beyond that is not publicly documented here.

Strengths

The four properties above, each checkable rather than asserted. For a provider reselling protection, and for an estate keeping evidence and classification inside a jurisdiction, they meet requirements that are otherwise awkward to satisfy.

Limitations and unknowns

• No first-party global scrubbing cloud. The upstream volumetric tier must be contracted separately — a property of on-premises appliances generally, but a real constraint on a single-supplier hybrid.
• Independent test coverage. Less third-party test and analyst material exists than for the long-established names here, so more of an evaluation has to be done rather than read.
• Documentation not yet public. The material this page rests on was read but cannot be read by you, and the manufacturer’s website describes an earlier generation. Until the consolidated guide is published, this profile is weaker evidence than its peers.
• Regional support scale relative to a multinational is a difference to establish locally.

Best fit

Service providers needing per-customer policies on shared hardware; organisations under a residency or evidence-custody obligation where classification leaving the country is the problem; estates that specifically want the two tiers under separate contracts.

Poor fit

Buyers wanting one supplier for both the on-premises tier and a global scrubbing cloud; organisations choosing primarily on the volume of independent test material available; estates whose only real exposure is volumetric saturation, where the upstream tier does the work.

POC questions

1. Disconnect the outbound path to the manufacturer, repeat the same application-layer test, compare the runs. Step degradation and graceful degradation are different answers.
2. Configure two tenants with different policies, attack one, verify isolation and per-customer reporting.
3. Replay your own application traffic alongside a Layer 7 attack and measure the false-positive rate at a genuine business peak.
4. Test at 64-byte packet sizes and record where behaviour changes; compare against the vendor-stated figure for the model quoted.
5. Trigger the bypass path deliberately and time the failover.
6. Export the telemetry an incident report needs, in your format and on your schedule.
7. Ask for sector references in your market and speak to them without the vendor present.