What is Network Type; how does it differ from IP Reputation?

Short answer

Network Type is the classification that shows what kind of network an IP address belongs to: a data center, a CDN, a verified bot, an anonymizer or an end-user network. It differs from IP Reputation in that it looks not at whether the address has been abused in the past, but at where it belongs; a data center address does not have to be bad. TR7 recognizes 5 categories (Datacenter, CDN, Verified Bot, Anonymizer (VPN / Proxy / Tor), End User) and 21 groups (e.g. Amazon AWS, Hetzner, Tor Exit Node, Mobile / CGNAT); each group is bound to a single category, and an address that is not in the classification data falls into no category. This classification is used in the Network Type Category and Network Type Group conditions in the Load Balancer, in the Network Type Group Control block in L7 DDoS Protection, in the IP Lookup result and on the Distribution tab of IP Intelligence & Reputation.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Conditions	Network Type Category, Network Type Group	An action or routing based on the network type
Bot/DDoS Management → L7 DDoS Protection	Network Type Group Control (including Exempt Network Groups)	A limit or a direct action on the requests and connections coming from a network group
Bot/DDoS Management → Bot Protection → Factors	Datacenter Ip, Tor Exit	The contribution of the network type to the bot score
Bot/DDoS → Event Logs	Network Type	The network group of the source
Settings → General Settings → IP Intelligence & Reputation → IP Lookup	The Network Type row	The group and the category of the address
IP Intelligence & Reputation → Distribution	Blacklist by Network Type, Network Category	The distribution of the blacklisted addresses by network type
Log profile and smart variable fields	%NETTYPE_GROUP, %NETTYPE_CATEGORY	Writing the network type to the log or to another field

Difference from IP Reputation

	Network Type	IP Reputation
Question it asks	What kind of network does the address belong to?	Has the address been reported for abuse?
Values	5 categories, 21 groups (e.g. Datacenter, Tor Exit Node)	Reputation categories (e.g. Brute-Force, Port Scan, Open Proxy, VPN IP)
Source	The network type database on the device	The IP reputation database, External sources and the manually added Blacklist content
Condition / protection in TR7	Network Type Category / group conditions, Network Type Group Control	The Blacklist IP Category condition, IP Reputation Protection

Common Misconceptions

• "Datacenter traffic is malicious." Legitimate traffic such as API clients, monitoring systems and company egress traffic also comes from data centers; the network type alone is not a reason for blocking.
• "Network Type and reputation are the same list." One shows the type of the network, the other the abuse history of the address; an address can be both in Datacenter and in a reputation category.
• "Every address falls into a category." An address that is not in the classification data falls into no category; for this address, the condition is not met.

Using the network type and reputation data together: How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?

How it is done in the documentation

• Network Type Category
• Network Type Group
• Network Type Group Control

Related questions

• How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?
• What is IP Reputation; where does TR7 use IP Reputation data?
• What is a Tor exit node; how does TR7 recognize Tor traffic?