XDP
Line-rate packet drops at the NIC — before traffic burns CPU or saturates your uplink.
On Premise
Run NorthShield on infrastructure you already control.
Run the same XDP and eBPF filtering stack on appliances you own and operate, ideal for private networks, regulated environments, and teams that need mitigation inside their facility.
Mitigation that never leaves your boundary.
On Premise is for teams that need the same XDP stack as our PoPs — on appliances they own, inside networks they operate, under policies they control.
When to choose On Premise
Remote Protection vs On Premise — different custody, same stack.
If traffic can leave your network for scrubbing, Remote Protection fits. If inspection must stay inside your facility or compliance perimeter, On Premise is the model.
Decision
Remote Protection
On Premise
Where filtering runs
NorthShield PoPs
Your hardware
Traffic path
GRE / IPIP or cross connect
Stays inside your boundary
Hardware custody
NorthShield edge
You own and operate
Best for
Remote prefixes & transit
Regulated / private edges
Software stack
Four layers. One mitigation philosophy.
On Premise is not a reduced appliance SKU. You get the same filtering layers we run at London, Frankfurt, and Istanbul — deployed on your gear.
eBPF
Programmable flow logic for protocol anomalies, state abuse, and custom vectors.
Policy
Local mitigation policy you control — same philosophy as our cloud PoPs.
Applications
Game, voice, remote access, and custom filters tuned for your stack.
Hardware guidance
Sized for your edge — not a generic box.
We help define NIC, CPU, memory, and platform requirements from your throughput and attack profile before anything ships to production.
NIC
Multi-queue NICs sized for your peak and attack profile.
CPU
Cores reserved for XDP/eBPF so mitigation never contends with apps.
Memory
Headroom for connection tables, caches, and concurrent filters.
Platform
Supported Linux appliances or servers you already operate.
Rollout
From sizing to go-live.
A clear engineering path — no black-box appliance drop and hope.
Sizing
Review throughput, attack profile, NIC, and redundancy needs.
Topology
Define ingress point, failover, and policy baseline.
Install
Deploy NorthShield software with XDP/eBPF tuning on your gear.
Go live
Handoff docs, escalation paths, and upgrade guidance.
Where it fits
Built for teams that cannot outsource the edge.
Private facilities, regulated networks, and internal service ingress — places where third-party scrub centers are not an option.
Private data centers
Colo racks and on-site facilities where you keep full hardware custody.
Compliance boundaries
Finance, healthcare, and government networks that cannot outsource the edge.
Internal service edges
APIs, panels, and private backends protected at ingress — not via a third-party scrub center.
Capabilities
What stays under your control.
Hardware, policy, and update windows remain yours. We bring the filtering stack and engineering support.
Customer-owned hardware
Installed on appliances and servers that stay under your ownership, patching, and ops procedures.
XDP on your edge
The same kernel filtering stack used in our PoPs, running where your traffic enters.
Local policy control
Tune mitigation next to the services and private paths that need protection.
Private network fit
Built for regulated environments and fabrics that cannot rely on external tunnels.
Hardware guidance
NIC, CPU, memory, and platform requirements based on your traffic shape.
Platform parity
Same filtering philosophy as Remote Protection and IP Transit — consistent policy thinking.
Included
Engineering support from sizing through go-live.
We validate platform fit and traffic shape before the stack goes live on your hardware.
- Hardware and platform suitability review
- Deployment architecture planning
- XDP/eBPF policy baseline
- Local traffic profile assessment
- Installation and go-live support
- Operational handoff documentation
- Incident summary reporting
- Upgrade and tuning guidance
Bring NorthShield into your own environment.
Tell us about your hardware, traffic profile, and compliance requirements. We will define the right on-premise deployment model.