, ROOM ALFA
Volumetric DDoS protection can run on a host that terminates TCP connections, on a router protecting downstream networks, or on a scrubbing node receiving redirected traffic.
These deployments differ in traffic visibility: a router-based filter may see mostly attack traffic or only client-to-server traffic. There are always-on, on-demand, and hybrid deployment models, and modern “hit-and-run” attacks challenge these architectures.
Despite the differences in network architecture, these volumetric DDoS filtering approaches share a lot of functionality, which can be implemented in Linux eBPF.
eBPF programs run at commodity Linux systems with capable yet standard network adapters. These programs run close to the network adapter driver and process traffic at 100+ Gbps on commodity servers.
In this talk, we:
-
consider open-source eBPF implementations of filters for TCP SYN, ACK and RST floods, DNS reflection and random UDP floods, ICMP floods
-
discuss how to mitigate attacks with spoofed source addresses
-
cover deployment safety and monitoring
-
evaluate performance of filtering eBPF programs running on an x86-64 server with 200Gps NIC.
Alexander Krizhanovsky is the CEO of Tempesta Technologies and the architect of Tempesta’s open-source full-stack DDoS protection and bot management platform, including Tempesta xFW for high-performance L3/L4 DDoS mitigation, Tempesta FW for L7 DDoS protection and web security, and WebShield for advanced bot management.
Alexander has designed and led the development of high-performance network traffic processing systems, including a Web Application Firewall mentioned in the Gartner Magic Quadrant, as well as highly scalable S3 and NFS servers with a focus on network I/O, multicore scalability, and efficient data processing.
He has given talks at CppCon, Netdev, SCALE, Linux Conf Australia, All Things Open, FOSDEM, SeaGL, Percona Live, IBM CASCON, and many other conferences. Alexander is also the author of a high-performance lock-free MPMC ring buffer queue published by Linux Journal.