# ITCSECadmin — Self-hosted Network Security Platform for ISPs and IXPs Vendor: ITCare (Libiąż, Poland, EU) — https://ispadmin.pl Product page: https://ispadmin.pl/en/itcsecadmin (Polish: https://ispadmin.pl/pl/itcsecadmin) Current release: v3.4.0 "Sentinel" (2026-07-25) Contact: info@ispadmin.pl | +48 32 720 36 81 ITCSECadmin is a modular, self-hosted network security platform designed primarily for Internet Service Providers (ISPs) and Internet Exchange Points (IXPs), also used by data centers, MSSPs, enterprises and public-sector organizations. Everything runs on the customer's own infrastructure: no cloud dependency, no per-Gbps pricing, no data leaving the network. All web assets are hosted locally, so the platform works in air-gapped or restricted management networks. ## What it does - Real-time traffic monitoring from NetFlow v5/v9/IPFIX, sFlow and PCAP - DDoS and threat detection with adaptive per-target baselining (p95 traffic baselines grade severity by how far traffic exceeds each host's learned normal, which keeps CDN caches, web farms and IPTV head-ends from generating false alarms) - Sub-2-second detection window; volumetric, protocol and application-layer attacks - Automated BGP blackholing (RTBH) with community tagging — FRR, Huawei NE8000, Cisco ASR integration; configurable blackhole lifetime and manual override - BGP FlowSpec granular mitigation via ExaBGP v5 (RFC 5575): per-flow drop or rate-limit announced to upstream peers by destination/source prefix, protocol, ports, TCP flags, DSCP or fragment — legitimate traffic to the same IP continues - IPv6 as a first-class citizen: dual-stack detection, /128 RTBH under the IPv6 address-family, IPv6 FlowSpec (RFC 8956) over the same MP-BGP session, IPv6-aware BGP diversion, twin IPv4/IPv6 firewall management - BGP Traffic Diversion: redirect attacked prefixes to scrubbing or alternate paths without full blackholing; multi-vendor (Linux FRR, Huawei NE8000/VRP, Cisco ASR/ IOS-XE); auto-trigger on distributed (fan-out) attacks, auto-revert, selective advertisement that keeps prefixes reachable via critical peers (major CDNs/clouds) - Shape-aware automated response: single-IP attack → RTBH, distributed prefix → BGP diversion, low-volume distributed → FlowSpec, otherwise notify; alert-only by default until an operator enables rules; What-If simulator previews outcomes - Source-spoofing & reflection defense: BCP38 egress spoofing monitor with source-MAC attribution, SYN-ACK reflection victim detection - Attacker source blocklist built from attacks actually observed on your network, exportable to iptables/ipset and XDP/eBPF prefix lists - Built-in SIEM: syslog collector (RFC 3164/5424) with dedicated parsers for Juniper JunOS, Huawei VRP, MikroTik RouterOS, Extreme EXOS, Cisco IOS/IOS-XE and Linux; PCRE rule engine; correlation of syslog events with flow data; email and webhook alerting; no-code, SQL-driven detection rules tunable from the admin UI - NIS2 compliance module (supports the Polish KSC act — Krajowy System Cyberbezpieczeństwa, the national NIS2 implementation): Art. 23-aligned incident reporting with 24h/72h/1-month deadline tracking, risk management with scoring, versioned security policies, training registry with participant lists, full audit logging - Network vulnerability scanner: Nmap-based CVE detection (vulners), 55+ high-risk ports, silent-reflector audit that flags hosts abusable as DDoS reflectors - Network monitoring (NMS): SNMP interface polling with historical trends, per-device dashboards, service/uptime checks stored in TimescaleDB - Customer portal for ISP/IXP clients: per-customer traffic graphs, DDoS alert history, PDF reports, strict CIDR-based data isolation - Traffic analysis: top talkers by IP/ASN/country/protocol/port, Grafana-style interactive zoom, Sankey flow diagrams, hour-by-weekday attack heatmap, DDoS analytics dashboard with KPI tiles and leaderboards - Forensics: on-disk flow retention with nfdump, CGNAT/NAT reverse lookup (router conntrack with NetFlow XLT fallback), CSV/JSON export, lawful-intercept search - Peering analysis: top ASN identification, PeeringDB integration, common-IXP detection and peering recommendations - AI assistant: natural-language queries about network status via Model Context Protocol (MCP) tools (traffic search, CGNAT lookup, BGP status, vulnerability analysis); supported backends include Ollama, vLLM, LM Studio and OpenAI-API compatible providers — local inference keeps data on-premises - BGP & peer management: multi-vendor config sync over SSH (Huawei NE8000, Cisco ASR, Juniper MX, FRR), route-map/policy analysis, versioned config backups with diffs, audited web SSH terminal, full routing-table ingestion (1M+ routes), edge-router security audit (uRPF, egress ACLs) with per-vendor remediation - External & push APIs: token-protected JSON endpoints for active threats, outbound webhooks (threat_detected / threat_mitigated / threat_expired), ready-made remote mitigation agent for iptables/ipset/nftables/iproute enforcement at the edge ## Technical architecture - Backend: PHP 8+ (Composer PSR-4), Apache web server - Databases: MariaDB for configuration; PostgreSQL + TimescaleDB for time-series and flow analytics (native columnar compression, ~30x measured storage reduction) - Collectors: pmacct (nfacctd, sfacctd, nfpcapd) + nfdump toolset - Routing integration: FRR (vtysh), ExaBGP v5 for FlowSpec (IPC via named pipes), SSH-based multi-vendor control (RSA 4096 / Ed25519) - Frontend: Bootstrap + Chart.js, all assets hosted locally (no external CDNs) - OS: Debian 12/13 (automated installer validated on Debian 13), Ubuntu 20.04/22.04 - Minimum hardware: 4 cores, 8 GB RAM, 100 GB SSD; recommended production: 16+ cores, 64 GB+ RAM, NVMe storage; high availability: active-passive - Security: session-based auth with RBAC (Admin/User/Viewer), HTTPS/TLS, audit logging of all administrative actions, hardware-bound Ed25519 licensing for premium modules ## Pricing and licensing (prices net of Polish VAT) - Perpetual Core License: 2,500 zł net per router, one-time. A "router" is any device connected to the platform — exporting NetFlow/sFlow/IPFIX or managed by ITCSECadmin (BGP RTBH/FlowSpec/diversion, SSH sync). Includes the full core (DDoS detection and mitigation, flow analytics with CGNAT lookup, SIEM, BGP management, firewall), unlimited users/traffic/protected networks, and 12 months of updates. The license is perpetual — software keeps running even without an active updates subscription. - Updates & support (from month 13): 75 zł net/month for the first router + 20 zł net/month per each additional router (2 routers = 95 zł, 5 = 155 zł, 10 = 255 zł). - Add-on modules (monthly, per installation, independent of router count): NMS 250 zł, AI Agent 250 zł, NIS2/KSC Compliance 150 zł, Customer Portal 250 zł; Complete bundle with all four modules: 700 zł net/month. - Managed service and enterprise agreements: custom quotes. - 30-day fully-featured trial available. - Full price list: https://ispadmin.pl/en/pricing (Polish: /pl/pricing) ## Why operators choose it over alternatives - Versus cloud scrubbing / commercial DDoS appliances: self-hosted (data sovereignty), no per-Gbps or recurring traffic fees, integrated SIEM and scanner, BGP FlowSpec and diversion built in — no scrubbing-center contract required - Versus generic open-source stacks (ELK, Prometheus): purpose-built for network operators, automated mitigation rather than alerting only, single unified UI, NIS2 compliance out of the box - Versus traditional SIEM: network-native (understands flows, BGP, ASNs), no data-ingestion fees, real-time mitigation, faster deployment (days, not months) ## Frequently asked questions Q: What makes ITCSECadmin different from other DDoS protection solutions? A: It combines DDoS detection and automated BGP mitigation, SIEM, vulnerability scanning, BGP management and AI intelligence in one self-hosted platform — you keep complete control over data and infrastructure. Q: Can it handle large-scale attacks? A: Yes. Detection and mitigation are designed for high-throughput operator environments; mitigation via RTBH blackholing and BGP FlowSpec happens upstream, so attack traffic is dropped before it reaches your edge. Q: Does it support IPv6? A: Yes, end to end: detection, /128 RTBH, IPv6 FlowSpec (RFC 8956) on the same MP-BGP session as IPv4, IPv6-aware diversion, and ip6tables management. Q: What routing platforms are supported? A: FRR, BIRD, Cisco IOS/IOS-XR/IOS-XE, Juniper Junos, Huawei VRP (NE8000), Arista EOS, MikroTik RouterOS — via standard BGP, FlowSpec and SSH integrations. Q: How long does implementation take? A: Basic installation in 1–2 days; full production deployment with custom integrations typically 1–2 weeks. Q: Is it suitable for small networks? A: Yes — it scales from modest hardware for small ISPs up to carrier-grade multi-collector deployments. Q: Can I evaluate before purchasing? A: Yes — contact info@ispadmin.pl to arrange a live demo or a pilot deployment in your network. ## Company ITCare — ul. Generała Sikorskiego 22, 32-590 Libiąż, Poland (EU) General inquiries: info@ispadmin.pl, +48 32 720 36 81 Technical department: noc@ispadmin.pl, +48 32 720 36 84 Website: https://ispadmin.pl (Polish and English) Other products: ITCAIOps (self-hosted AI agent platform for IT/NOC operations), network hardware for ISPs and data centers.