Telco
Telco carriers
At the subscriber edge, DHCP is where your network meets the customer's device — and it is the layer most carriers have the least visibility into. You need quality of service for a shared resource, protection against DHCP-targeted abuse, the ability to attribute a request back to a subscriber, and a record you can hand a regulator. Shield Pro does all four from one place in the path.
It sits in line, parses every DISCOVER / OFFER / REQUEST / ACK and the DHCPv6 equivalents at the protocol level, and extracts the relay-agent Option 82 Circuit-ID and Remote-ID so a request maps back to the subscriber port it came from. Threshold and rate rules flag DHCP floods, starvation attempts, and coordinated bursts; the throttle action rate-limits a noisy-but-valid client instead of cutting it off, so one misbehaving CPE does not degrade the pool for everyone. Every transaction is recorded in ClickHouse with configurable retention, and every operator and enforcement action is written to an audit log that is retained indefinitely by default.
Deep packet inspection
Kernel-level enforcement
Distributed carriers can run the mirrored deployment mode: a lightweight capture agent at each remote site forwards DHCP traffic over TZSP to a central collector for inspection, giving cross-site visibility without placing an enforcement appliance at every location.
Enterprise
Large enterprise
For a large enterprise network the pressure is reliability, control, and security — in that order. The DHCP layer touches every device that joins the network, and for most teams it is a black box: leases get handed out, but nobody can say in real time what is on the wire or act on it without standing up a separate enforcement plane. Shield Pro gives you the visibility and the control from the same appliance, and it is built so your DHCP service never depends on it staying up.
It inspects every transaction live, surfaces anomalies — identity inconsistencies, vendor-class variation, message-type imbalance, burst patterns — for review (with an optional local LLM for analysis), and lets an operator block, deny, throttle, allow, or monitor a client directly from the stream. Enforcement happens inside the Linux kernel; if the inspection service ever stops, the kernel passes DHCP through untouched — fail-open by design. Role-based access (viewer, operator, admin) and an indefinite audit trail give you the control story for the security review.
Anomaly detection
Kernel-level enforcement
Start in mirrored mode to evaluate against live traffic with zero risk, then switch to inline enforcement once you trust the detection. A native Model Context Protocol server lets your team triage and act from Claude Code, with writes gated behind an admin token.
Enforcement inside the Linux kernel — fail-open by design.
ISP & hosting
ISP & hosting
ISPs and hosting providers face the same DHCP-edge problem as carriers, at a different scale: per-customer visibility, abuse detection, and audit-grade retention. Shield Pro inspects every lease in line, extracts the Option 82 relay-agent fields that attribute a request to the customer it came from, and flags abuse indicators — sudden churn, floods, atypical option fingerprints — as they happen rather than after the complaint ticket.
Transaction history lives in ClickHouse with configurable retention and a custom report builder, so when an abuse report or law-enforcement request lands, correlating it is a query rather than a half-day of engineers diffing packet-capture archives. The audit log of operator and enforcement actions is retained indefinitely by default.
Real-time monitoring
Analytics & reporting
Multi-site providers can centralise visibility with the mirrored TZSP deployment — one collector inspecting traffic forwarded from capture agents at each site.
Education
Education & campus
Campus networks run the most diverse DHCP environment anywhere: BYOD laptops, dorm consoles, lab equipment, and a long tail of one-off academic gear, all churning hardest the week the term starts. The job is two-fold — filter and shape the DHCP traffic on each VLAN, and manage the underlying Netfilter ruleset that does it without hand-editing nftables on a console. Shield Pro is built for both.
It gives the network team a live picture of who is leasing on each segment and which vendor class they present, surfaces anomalies that suggest a misconfigured or abusive device, and lets an operator throttle or block from the same screen. The firewall manager and live flow visualiser show what the kernel ruleset is doing right now — set sizing, per-action rate limits, and the chain a packet took — so managing the firewall layer is a GUI task, not a console session.