This is a pricing analysis post. We sell Flowtriq, which uses per-node pricing, so we have a position on licensing models. All figures below come from publicly available pricing pages as of May 2026.
How bandwidth-based licensing works
In a bandwidth-based licensing model, you purchase a detection license for a maximum traffic volume. If your network's observed traffic exceeds that volume, you must upgrade to the next tier.
FastNetMon Advanced is the most prominent DDoS detection tool using this model. According to their pricing page:
| Tier | Monthly | Annual | Support Tickets |
|---|---|---|---|
| 10 Gbps | $115/mo | $1,380/yr | 1/month |
| 40 Gbps | $220/mo | $2,640/yr | 2/month |
| 100 Gbps | $350/mo | $4,200/yr | 3/month |
| Enterprise | Custom | Custom | Dedicated |
The license must cover your entire network bandwidth, even if you are only monitoring a portion of it. There is also an $85 one-time activation fee on non-enterprise monthly plans.
The tier jump problem
Bandwidth-based licensing creates a staircase pricing curve. You pay the same whether you use 1 Gbps or 9.9 Gbps on the 10G plan. But the moment you cross 10 Gbps, you jump to the 40G plan at $220/month, an increase of $105/month (91% more) for potentially a single Gbps of additional traffic.
This creates specific problems for growing networks:
- Seasonal spikes: A hosting provider that runs at 8 Gbps normally but peaks at 12 Gbps during Black Friday needs the 40G tier year-round for one month's peak. That is $105/month extra for 11 months of headroom they do not use.
- Organic growth: An ISP growing at 15% annually will cross a tier boundary every few years. Each crossing is a step-function cost increase, not a gradual ramp.
- Attack traffic: During a volumetric DDoS attack, your observed traffic may temporarily exceed your tier. The tool you rely on for detection becomes misaligned with the traffic it needs to monitor at the exact moment monitoring matters most.
Bandwidth licensing vs. other models
Three licensing models exist in the DDoS detection market:
1. Bandwidth-based (FastNetMon)
Cost scales with traffic volume. Predictable for stable networks, punitive for growing or peaky ones. You pay for capacity, not utilization.
2. Per-component (Andrisoft Wanguard)
Wanguard charges per functional component: $595/year per Sensor license and $995/year per Filter license, according to their online store. Cost scales with the number of sensors and filters deployed, not traffic volume. A single Sensor license covers one flow exporter with no traffic volume limit.
This model avoids the bandwidth tier problem but introduces its own scaling issue: multi-site ISPs with many flow exporters need many Sensor licenses. Five routers exporting NetFlow means five Sensor licenses at $2,975/year.
3. Per-node (Flowtriq)
Flowtriq charges $9.99/node/month regardless of traffic volume. A node processing 100 Mbps costs the same as one processing 10 Gbps. Cost scales with infrastructure footprint, not traffic.
How the models compare at scale
| Scenario | FastNetMon | Wanguard | Flowtriq |
|---|---|---|---|
| 1 site, 10 Gbps, 5 nodes | $115/mo | ~$133/mo (Sensor + Filter) | $49.95/mo |
| 1 site, 40 Gbps, 10 nodes | $220/mo | ~$133/mo | $99.90/mo |
| 3 sites, 100 Gbps total, 20 nodes | $350/mo | ~$398/mo (3x Sensor + 3x Filter) | $199.80/mo |
| 3 sites, 100 Gbps, 50 nodes | $350/mo | ~$398/mo | $499.50/mo |
Note: FastNetMon prices above do not include LiveView ($70/user/month), the $85 activation fee, or dedicated server costs ($60-150/month). Wanguard prices do not include Priority or Enterprise Support add-ons. Flowtriq includes dashboard, unlimited users, and support.
No model wins in every scenario. Bandwidth-based licensing is cheapest when you have high traffic but few nodes. Per-component licensing is cheapest when you have few sites but high traffic. Per-node pricing is cheapest when you have many nodes but moderate traffic per node. The important thing is to model your actual deployment, not compare headline prices.
The forecasting problem
The hardest cost to account for with bandwidth-based licensing is the one you do not see yet: the next tier upgrade. If you sign a 12-month contract at the 10 Gbps tier and your traffic grows past 10 Gbps in month 8, you face a choice:
- Upgrade mid-contract and absorb the cost increase immediately
- Continue on the current tier and risk inaccurate detection if the tool is not monitoring all traffic
- Wait until renewal and accept the higher tier as the new baseline
With per-node or per-component licensing, growth means adding nodes or components incrementally. The cost increase is proportional to the infrastructure added, not a tier jump.
What to ask during evaluation
- What metric determines my tier? Peak traffic, 95th percentile, or average? The definition matters for networks with variable traffic.
- What happens if I exceed my tier temporarily? Does detection degrade, does the license block, or does it continue working with an upgrade notice?
- Can I trial at a higher tier? Testing on a 10G license when your network peaks at 15G will not give you an accurate evaluation.
- What does the tier above me cost? Know the next jump before you sign, not when you need it.
- Is there a mid-contract upgrade path? Pro-rated upgrades are better than paying the full new tier price for the remaining months.
No bandwidth tiers. No tier jumps. $9.99/node/month.
Flowtriq pricing does not change when your traffic grows. Detection, mitigation, dashboard, unlimited users, and support included in every plan.
Start Free Trial →Frequently asked questions
What is bandwidth-based DDoS licensing?
What happens if my traffic exceeds my licensed tier?
What are the alternatives to bandwidth-based licensing?
The bottom line
Bandwidth-based licensing is straightforward to understand: bigger network, bigger bill. But the staircase pricing curve creates cost discontinuities that do not match how networks actually grow. Traffic does not jump from 10 Gbps to 40 Gbps overnight, but the license cost does. Model your actual deployment across 12-24 months, including growth projections and seasonal peaks, before comparing the headline tier prices. The cheapest tier today may not be the cheapest model in a year.