Path.net

What Path Network actually is

Path Network (path.net) is a pure-play DDoS mitigation provider: you announce your subnets to its network over BGP, its anycast scrubbing centers absorb and filter attack traffic, and clean traffic comes back to you. It is not a hosting company that bolted on protection — filtering is the whole product. The company is small (11-50 employees on its LinkedIn profile), founded in 2018, headquartered in the United States (its own blog lists Phoenix, Arizona; some registries list other US cities), and it sells to exactly the audience that gets hit hardest: game hosts, web hosts, blockchain projects, VoIP providers, and network operators. The public customer list includes U-Haul, Iridium Satellite Communications, ClouDNS, Zenlayer, MojoHost, Limestone Networks, ReliableSite, NameHero, SpectrumVOIP, and 123NET.

The technical pitch, straight from their site: a 12 Tbps global network capacity deployed over 22 of the largest internet hubs, with customer subnets advertised from every node so attacks are filtered at the scrubbing center nearest the source. Mitigation runs across layers 3 through 7 and combines three claims we find credible: a patented stateful cloud firewall that tracks connection state rather than dropping on signatures alone, eBPF/XDP-based packet filtering at line rate (XDP is genuinely the fast path for packet drops in Linux, and taking it seriously is a good sign), and an open-source multi-layer security stack that they argue is auditable by outsiders.

Note that our database said 9 Tbps; the current published figure is 12 Tbps, and the same number appears in their partner integrations. In a market where mitigation vendors have historically inflated capacity claims, 12 Tbps is large but not implausible — Cloudflare and Akamai publish vastly larger global numbers, but those are CDN-class networks; among dedicated scrubbing providers this is a serious figure.

Pricing: what you really pay

Here we have to be honest about the limits of our research: Path Network publishes no price list. There is no public per-plan pricing on path.net, and buying is a conversation — the company positions itself against "under attack fees," arguing that mitigation should be affordable and not priced punitively when you are already suffering, and it advertises same-day setup without hardware.

What we can report are third-party anecdotes, which are not quotes: one Web Hosting Talk thread mentions being quoted $400/month for two servers, and a community recommendation thread describes the service as "the best choice if you have a big network, but it's gonna be $500+ per month." Treat both as directional noise. Our database lists a minimum price of $300; we could not verify that against any published source and have marked the value unverified rather than repeat it. Budget in the high hundreds per month for a small deployment and expect custom pricing for larger announcements — and get it in writing, including what happens to the bill when you come under sustained attack.

The honest comparison framing: bare DDoS capacity from the big CDNs and clouds is either bundled (Cloudflare's free and Pro tiers, AWS Shield Standard) or enterprise-priced (AWS Shield Advanced, Akamai, Cloudflare Magic Transit), while specialist scrubbing providers like Path, Path-style BGP services, and competitors such as Path's FastNetMon-adjacent peers sell on mitigation quality rather than sticker price. If your attack profile is mostly L3/L4 floods against game or VoIP infrastructure, specialist scrubbing is worth paying for; if you mostly need L7 protection for a website, a CDN with a WAF will be cheaper and simpler.

Performance & infrastructure

The network is the product, and the claims are concrete: 12 Tbps of capacity over 22 internet hubs, anycast advertisement of customer subnets from all nodes, and filtering nearest the attack source. The company's blog names US points of presence including Los Angeles, New York, Chicago, and Dallas (announced as an expansion in 2020), and describes global hub coverage without publishing a full city list. We could not verify specific European or Asia-Pacific node locations, so we leave those region flags open rather than repeat marketing shorthand.

On mitigation technique, the stateful firewall plus XDP combination is the right architecture for volumetric attacks: state tracking kills spoofed and unsolicited traffic efficiently, and XDP drops packets before they reach the normal network stack, which is what keeps latency sane during a flood. The integration story is practical rather than glamorous — a FastNetMon Advanced integration puts Path's scrubbing behind FastNetMon's detection, and setup is BGP-based with same-day onboarding claimed, no appliance shipping.

Credibility signals worth weighing: the company's team includes people with published vulnerability-research and incident-response backgrounds, and its site lists recognition from US government bug-bounty programs (Hack the Pentagon, Hack the U.S. Army, Hack the U.S. Air Force). For a security vendor of this size, that plus a customer list of infrastructure operators is a more meaningful signal than any capacity number.

We have not tested Path Network's mitigation ourselves — testing would require being under a real attack — so every performance statement above is a claim we have attributed, not a result we measured.

Where it falls short

Opacity is the first problem. No public pricing, no published SLA document we could find, and no self-service signup means every buyer starts with a sales conversation. For a product whose entire value shows up during emergencies, the absence of a published availability or mitigation commitment is a real gap; established competitors publish SLAs with credits, and buyers doing procurement checklists will notice.

Second, company size cuts both ways. Eleven-to-fifty employees means you talk to engineers rather than account managers, and a Tier 3 24x7 support claim is credible at that size only if the team is genuinely staffed around the clock — worth probing in the sales process with references from your own industry. It also means less geographic redundancy in support and sales than the giants offer.

Third, the product scope is narrow by design. This is scrubbing and BGP mitigation, not a CDN, not a WAF-first platform, and not a general security suite. If your real need is L7 application protection, bot management, or API security, Path Network is a complement to other tools, not a replacement.

Finally, the region picture is under-documented: the site says 22 hubs but does not map them, which makes it hard to reason about scrubbing latency for APAC or South American traffic before you buy.

One procurement note for regulated buyers: DDoS mitigation sits in the availability half of most risk registers, so the paperwork matters as much as the packets. If your compliance regime requires a contractual uptime or mitigation commitment, put that requirement at the top of the first call and treat a verbal assurance as a gap — we would rather see a modest written SLA than a large unwritten one.

Who should pick this

We pick Path Network when the threat model is volumetric and the traffic is unfriendly to CDNs: game servers carrying UDP services, VoIP, web hosts shielding customer infrastructure, and network operators who need BGP-level scrubbing without buying hardware. The same-day setup and the flat "no under-attack fees" posture make it a good emergency option when an attack is already happening and your upstream is asking questions.

We would not pick it for a small marketing site (put a CDN in front and pay far less), for buyers who need SLA paperwork for compliance, or for teams wanting self-service onboarding and transparent list pricing. Ask for references in your vertical, get the pricing and surge terms in writing, and test the failover path before you need it.

Finally, keep the fallback plan outside the vendor: whatever mitigation you buy, DNS and authoritative services should not depend on the same network path being scrubbed, and your incident runbook should name the moment you pull the trigger on upstream null-routing or provider failover. Mitigation is one layer of staying online, not the whole story.

Key takeaways

• Pure-play BGP DDoS mitigation: anycast scrubbing across 22 internet hubs with a 12 Tbps published network capacity.
• Stateful cloud firewall (patented) plus eBPF/XDP line-rate filtering across layers 3-7; open-source security stack.
• Founded 2018, US-based (Phoenix per its own blog), 11-50 employees; customers include hosts, VoIP and infrastructure operators.
• No public price list or SLA we could find; buying is quote-based (anecdotes suggest several hundred dollars a month).
• Our database's 9 Tbps figure is stale — the published capacity is 12 Tbps — and the $300 entry price is unverified.
• Our pick for volumetric attacks on UDP-heavy infrastructure; not for L7 web protection or SLA-driven procurement.

Sources

• http://www.path.net/
• https://blog.path.net/path-network-pop-expansion-chicago-dallas-future-plans
• https://blog.path.net/path-network-ddos-mitigation-fastnetmon-customers
• https://blog.path.net/author/path-network/
• https://linkedin.com/company/pathnetwork
• https://bitcoinwiki.org/wiki/Path_network
• https://webhostingtalk.com/showthread.php?t=1815381
• https://builtbybit.com/threads/anti-ddos-req.699290