DDoS filter adding 80ms latency in 'monitoring' mode

Vendor said "monitoring mode still inspects packets, just doesn't drop." Documentation said "transparent pass-through, zero added latency."

I run a small VPS shop on RackNerd gear. Bought their "DDoS shield" add-on. Set to monitoring while I tested. My gaming customers noticed immediately. I noticed when they noticed, which was faster than my monitoring.

Vendor eventually admitted: "the documentation was incorrect. Monitoring mode runs through the same inspection path. We will update the docs." I got a feature flag to disable inspection entirely for my subnet. Others might not know to ask.

So I had this exact thing with a different vendor last year (not RackNerd, someone else, won't name them because they fixed it and I like their support team) and the thing about these filters is they're never actually passive right even when they say passive there's always some buffering or reassembly or at least a span port involved and span ports add microseconds but when you're talking about an inline device that's doing flow analysis or whatever they're calling it this week (NetFlow on steroids, sFlow but angry, pick your buzzword) there's always memory allocation and that adds time and time is latency and 80ms is a lot but also not a lot compared to what it could be if they were actually dropping traffic because then you'd have 100% loss not 80ms of delay but the real issue here is the documentation gap between what the sales team thinks the product does and what the engineering te

How to say... actually I have the same with my provider ! They told me "monitoring mode" but I have +45ms on my s3rver. It doesn't go.

I asked them "is it really transparent" and they said "yes, actually" but my ping says no. I think they don't know their own product. Very based of them to admit the doc was wrong, mine doesn't admit anything.

Do you have a feature flag too ? Or only for big customers ? I am small, maybe they don't care.

Bro 80ms on a gamr server is literally unplayable, vibe check before you buy any "monitoring" filter

Poggers that you got a feature flag tho, most ppl just get "works as intended" and a refund denial

Bettr fix: disable that junk and get a bettr upstream, or host with someone who doesn't lie in docs

S3rver latency is life, literally

Docs said zero latency, vendor admitted it was wrong. Classic.

Same issue, different vendor. "monitoring" still inspects, always.