Start-up IntruGuard Devices will use the NetWorld+Interop show this week to launch rate-based equipment designed to protect servers from denial-of-service attacks.

The company's first two appliances, the IG200 and IG2000, sit between servers and the Internet, cutting off server-bound traffic that exceeds customer-set thresholds. These spikes are an early warning that a DoS attack is underway that could overwhelm the servers.

What could set IntruGuard apart from other vendors selling this type of equipment is that it has developed chips to handle traffic sorting and it has the benefit of seeing what other vendors have tried, says Rodney Thayer, a network security consultant with Canola-Jones and a member of Network World's Lab Alliance test program. Competitors include Captus Networks, DeepNines Technologies, Top Layer Networks and Vsecure Technologies.

Products from these companies use policies to limit traffic that can reach servers, and each has its own set of tools for defining traffic to be controlled and what to do when limits are exceeded. The products also differ in whether they include other security such as firewalls.

Thayer, who tested these other systems for Network World (see review), says his subsequent test of the IntruGuard gear showed it should deliver the best performance for server farms with eight to 20 servers.

Beta tester Fiber Internet Center, a hosting provider in Palo Alto, says the appliance can cut off DoS attacks nearly 30 seconds faster than an Extreme Networks Black Diamond switch that the company has configured to limit traffic rates to stop DoS attacks. According to the center's founder, Bob Evans, the appliance protects a server for a site that sells conservative political books that gets attacked six to eight times per day. While it doesn't sound like much, enough session requests can come in 30 seconds to slow down the server or even crash it, he says.

The IG200 and 2000 can set up to eight different rate policies based on Layer 2, 3 and 4 parameters for different sets of servers that a single box could protect.

Scheduled to be available in July, the Fast Ethernet IG200 will cost $12,000, and the Gigabit Ethernet IG2000 will cost $25,000.