RioRey DDoS mitigation appliance

RE110: DDoS Mitigation for 40G and 100G Networks

The RE110 is the successor to the RE100: a new hardware platform built for long-term component availability, running the same RIOS analytics, with substantially higher packet filtering capacity. Up to 133 million packets per second on a single appliance, across three license levels.

One chassis. Three licenses. License-upgradable to full RE110 throughput without changing hardware.

Request RE110 pricing Compare license levels Download PDF specifications

License levels

RE110 License Levels

Every RE110 is the same appliance. The license sets its filtering capacity, so you can deploy at the capacity your traffic needs today and upgrade in place as it grows.

  • RE110 20G

    20 Gbps license

    Up to 32 million packets per second.

  • RE110 40G

    40 Gbps license

    Up to 83 million packets per second.

  • RE110 100G

    100 Gbps license

    Up to 133 million packets per second.

Dashed line: approximately 148.8 million packets per second, the theoretical packet rate of a 100 Gbps link carrying minimum-size (64 byte) Ethernet frames.

Why packet rate matters

Packet Rate Is the Real Limit, Not Bandwidth

Most DDoS mitigation hardware runs out of packet processing capacity long before it runs out of bandwidth. Floods built from small packets, such as SYN floods and many UDP floods, push very high packet rates through modest bandwidth, and that is where general-purpose equipment falls over.

The RE110 is sized around packets per second for that reason. Its capacity applies to the attack traffic itself, so a small-packet flood on a 100G link is the case it was built for, not an edge case.

RE100 to RE110

What Changed from the RE100

The RE110 is a new hardware platform, built around components with a longer supply horizon. The RIOS mitigation engine, attack coverage, and rWeb management carry over unchanged. The newer hardware raises filtering capacity and adds a 20G entry license.

Maximum attack packet throughput by license level
License level RE100 RE110
20 Gbps Not offered Up to 32M pps
40 Gbps Up to 40M pps (RE100/40) Up to 83M pps
100 Gbps Up to 80M pps Up to 133M pps

Deployment

Where the RE110 Fits in Your Network

The RE110 deploys in-line for always-on protection or off-ramp in a scrubbing center, and it plugs into the rest of the RioRey architecture without integration work between vendors.

In-line deployment: Internet traffic passes through the RE110 before reaching the protected network Internet RE110 Network

In-line at the Edge

All traffic passes through the RE110. RIOS filters continuously at line rate, with no operator action needed to start mitigation and no learning period.

Off-ramp deployment: Director detects an attack from flow data and diverts traffic through the RE110, which returns clean traffic to the router Router Director RE110 Network

Off-ramp with Director

RioRey Director watches NetFlow and sFlow and diverts traffic for a targeted destination through the RE110 only when an attack is detected. Normal traffic never touches the filter.

Hybrid deployment: the RE110 handles attacks at the edge, and attacks that exceed link capacity are escalated to rCloud scrubbing rCloud Internet RE110 Network

Hybrid with rCloud

The RE110 handles attacks at your edge. When an attack exceeds your link capacity, Director escalates it to rCloud, which runs the same RIOS engine. One vendor, end to end.

Attack coverage

All 25 Attack Classes, Identified by Method

RIOS identifies attacks by their underlying methodology rather than by signatures or the name of the tool that launched them. A new attack tool is a new variation of a method RIOS already recognizes, not a zero-day. There are no signatures to update and no rules to write, and mitigation typically begins within 0 to 90 seconds.

See the full RioRey Taxonomy of DDoS Attacks.

TCP Based

  • SYN Flood
  • SYN-ACK Flood
  • ACK & PUSH ACK Flood
  • Fragmented ACK
  • RST or FIN Flood
  • Synonymous IP
  • Fake Session
  • Session Attack
  • Misused Application

TCP-HTTP Based

  • HTTP Fragmentation
  • Excessive VERB
  • Excessive VERB Single Session
  • Multiple VERB Single Request
  • Recursive GET
  • Random Recursive GET
  • Faulty Application

UDP Based

  • UDP Flood
  • UDP Fragmentation
  • DNS Flood
  • VoIP Flood
  • Media Data Flood
  • Non-Spoofed UDP Flood

ICMP Based

  • ICMP Flood
  • ICMP Fragmentation
  • Ping Flood

Management

Managed in rWeb, Alongside Everything Else

The RE110 is managed through rWeb, the same platform that runs every RioRey appliance, VM, and rCloud deployment. Zones, per-class mitigation settings, real-time and historical traffic, and multi-tenant customer portals all work the same way they do on the rest of your RioRey estate.

For operators offering DDoS protection as a service, that means an RE110 can be added to an existing customer-facing deployment without a new operational model.

RE110 Technical Specifications

The RE110 specification sheet covers performance by license level, interfaces, session capacity, exception listing, management, power, and form factor.

Download the RE110 specification sheet (PDF)

FAQ

RE110 Questions

How is the RE110 different from the RE100?

The RE110 is a new hardware platform, developed to secure the long-term availability of its components. Changes in the supply chain made several RE100 components increasingly difficult to source, so RioRey rebuilt the platform around components with a longer, more predictable supply horizon. The newer hardware also raised the performance ceiling. The RE110 filters up to 83 million packets per second on its 40G license and up to 133 million on its 100G license, compared with 40 million and 80 million on the RE100, and adds a 20G entry license rated at up to 32 million packets per second. It runs the same RIOS mitigation software, covers the same 25 attack classes in the RioRey Taxonomy of DDoS Attacks, and is managed in the same rWeb platform.

I recently purchased an RE100. Is it obsolete?

No. The RE110 was introduced to secure component supply for the years ahead, not because the RE100 fell short. Your RE100 runs RIOS, protects against all 25 attack classes in the RioRey Taxonomy of DDoS Attacks, and is managed in rWeb alongside the RE110 and every other RioRey platform. RE100 units remain supported under their existing maintenance agreements and continue to receive RIOS updates, and an RE100 and an RE110 can operate side by side under a single rWeb.

Can I move to a higher license without replacing hardware?

Yes. Every RE110 is the same appliance, and the license determines its capacity. The 20G and 40G licenses are license-upgradable to full RE110 throughput.

Which DDoS attacks does the RE110 mitigate?

All 25 attack classes in the RioRey Taxonomy of DDoS Attacks, across TCP, TCP-HTTP, UDP, and ICMP, at Layer 3, Layer 4, and Layer 7. Detection is based on attack methodology, not signatures.

Can the RE110 be deployed off-ramp or in a hybrid architecture?

Yes. The RE110 can be deployed in-line or off-ramp. Paired with RioRey Director, it can receive diverted attack traffic in a scrubbing center, and Director can escalate attacks that exceed local capacity to rCloud, which runs the same RIOS analytics.

Where can I find RE110 pricing and full specifications?

Hardware pricing is available on request through the RioRey contact page. Full specifications are in the RE110 specification sheet (PDF).

Size Your RE110 Deployment

Tell us your link speeds, typical utilization, and deployment model, and we will recommend a license level and architecture.

Talk to RioRey All RioRey hardware