OpenShield-XDP
OpenShield-XDP
DDoS mitigation inside the NIC driver — attacks die before the kernel sees them.
How it works
01
Attach at line rate
One eBPF program loads onto your NIC (XDP). No appliance, no reroute, no kernel patches — kernels 5.15 through latest, zero user fixes.
02
Detect in microseconds
Every packet is scored: rates, protocols, ports, baselines learned over 30 days, per-destination tracking. Spikes are declared from your own traffic's shape, not static guesses.
03
Mitigate and report
Offenders are banned at XDP, floods are shaped per protocol/port, and you get live metrics, attack forensics with PCAP, and Discord reports when it's over.
Features
XDP line rate
10M+ pps per core — mitigation happens in the driver, before the network stack pays for it.
30-day adaptive baseline
Learns your normal per-hour, per-day shape and triggers on deviation, with spike and burst-proof EMA floors.
Full protocol coverage
SYN, UDP, TCP, ICMP floods, amplification (8 protocols), L7 payload signatures, geo blocking, auto-updating threat feeds.
Self-healing
Autoload watchdog re-attaches XDP if it ever detaches; config guard disarms itself on edits so a bad config can't loop.
Live metrics + control API
JSON snapshot of everything the TUI shows, plus remote control: bans, geo, config, baseline import/export.
The filtering pipeline, step by step
Every packet crosses five eBPF stage programs chained by tail call, with its parsed context carried in a scratch map. Total budget: a handful of microseconds per packet.
NIC
XDP attach
- The program loads directly into the NIC driver — before the kernel network stack exists for this packet
- Parse once: Ethernet, VLAN, IPv4/IPv6, TCP/UDP/ICMP into scalars (offsets masked for the verifier)
01
Pre-filter
- Full-bypass whitelist: 3-hash SplitMix64 bloom filter first, then the whitelist maps
- ARP/malformed sanity — junk never reaches the pipeline
02
Access
- Ban stage: pinned (permanent/heavy) bans first, then LRU bans — a hit is an instant drop
- Subnet LPM bans v4+v6: manual, feed-driven, and geo country blocks (always or attack-only)
- Blacklist, then tenant blackhole: all traffic to a blackholed destination dies here
03
Inspect
- Amplification check: payload-verified for 8 reflection protocols (DNS QR bit, NTP mode-7, SSDP prefix)
- L7 signatures: 16 byte-pattern slots, offset + mask-and-compare (~10ns each)
- Anti-amplification: our own response windows — suspected reflection sources lose their exemption
04
State
- Per-port and per-protocol windows: pps/bps counters with poison-resistant EMA baselines
- New-connection cap per destination port (always on, 1s windows)
- Protected sources: socket-truth established clients; the set freezes mid-engagement
- New sources are rate-limited; connection state is tracked per flow
05
Mitigate
- Early spike trigger: rate over cap AND over 8× EMA → capped inside the first second
- Attack declaration from baseline deviation → dynamic per-port/protocol caps engage
- Suspicion scoring and ban promotion: LRU for the crowd, pinned for repeat offenders
→
Verdict
XDP_DROP
banned, blackholed, over cap, malformed, or flood — gone for ~0 cost
XDP_PASS
clean or proven traffic continues to the kernel and your application
XDP_TX
SYN-cookie replies fire straight back out the NIC for handshake validation
Everything it does
The complete capability inventory, grouped by subsystem.
Detection engine & ML baseline
30-day adaptive baseline
Learns your per-hour, per-day-of-week traffic shape and merges it live with recency weighting. Spike thresholds are computed from your own normal — not static guesses.
Early spike trigger
A port or protocol over its cap AND over 8× its learned EMA gets capped in the first second — no waiting for an attack declaration. Burst-flood bypasses die here.
Behavior clusters
Machine-paced timing, per-port learned profiles and suspicion scoring with auto-block. Botnets that shape like humans get caught anyway.
Protected sources
Clients proven by real socket state (established TCP, not mintable kernel marks). During an engagement the set freezes: legit users keep flowing, floods can't mint exemptions.
Per-destination tracking
Every tracked destination IP gets its own pps/bps/drop series, window aggregates and full attack history — the DstIP analyzer.
New-source discipline
First-time senders are rate-limited on sight. Presence is earned through completed handshakes, never assumed.
Flood coverage
Volumetric floods
SYN, UDP, TCP and ICMP floods at XDP line rate — 10M+ pps per core, with static thresholds plus dynamic attack-driven caps.
Amplification & reflection (8 protocols)
DNS, NTP, SSDP, Memcached, QOTD, CHARGEN, RIP and TFTP — payload-verified (DNS QR bit, NTP mode-7, SSDP HTTP prefix), not just port matching.
Carpet-bomb & rotation-proof
Aggregate ICMP/UDP protocol caps with their own EMA baselines catch the floods that rotate through every port at once.
Burst floods
The >8× EMA early trigger fires inside the first second of a spike — before the baseline window even rolls over.
L7 payload attacks
16 configurable byte-pattern signature slots (offset + mask-and-compare, ~10ns each) plus auto-updating signature feeds.
Geo floods
Country blocking over LPM tries in both families, always-on or attack-only enforcement, single longest-match lookup per packet.
Mitigation mechanics
Ban tiers that hold
LRU maps absorb crowd bans while pinned maps keep heavy/repeat offenders — flood churn can never evict the worst actors.
SYN cookies with self-probe
Legit clients complete real handshakes while spoofed SYN floods die in the driver. The engine probes itself to prove it works.
Tenant blackhole
Drop ALL traffic to one destination IP — timed or indefinite, established-pair grace, auto-extend while triggered, HTTP control.
Egress policer (opt-in)
A TC egress twin caps outbound per source IP, so one compromised tenant VM can't flood out and get your host null-routed.
Whitelist architecture
Full-bypass lists accelerated by a 3-hash SplitMix64 bloom filter, plus subnet LPM bans in both families.
Per-port & per-protocol shaping
Dynamic caps learned from completed windows, with poison-resistant baselines that only update from clean traffic.
Forensics & operations
Per-attack PCAP + reports
Every attack gets a packet capture and a magnitude analysis: peak/avg/p95 rates, unique sources, protocol mix.
Discord attack reports
Attack-detected alerts, then a full breakdown when it ends: magnitude, time to mitigation, and total attack time including contained phases.
Full metrics + control API
Everything the TUI shows as JSON, plus remote control: bans, whitelist/blacklist, geo, config, baseline import/export, bulk-ban.
Config history & rollback
Every rendered config is versioned and encrypted at rest — diff and roll back any change in one click.
Self-updating
Signed releases from the Altis channel with checksums and automatic rollback if an update fails.
Autoload watchdog
Restarts a dead loader, re-attaches a detached XDP, and disarms itself on any config change — a bad config can never restart-loop the box.
Portability & scale
Kernels 5.15 → latest, zero fixes
Every pipeline stage is verifier-clean on the oldest supported kernel, and a Go gate test-loads the all-features worst case before every ship.
Tail-call architecture
A dispatcher plus five stage programs chained with per-packet context — optional freplace hot-patching on kernel 6.10+.
Full IPv6 parity
v4 and v6 keys, LPM tries, bans and tracking behave identically across both families.
Bloom-accelerated whitelist
A 3-hash SplitMix64 bloom filter short-circuits whitelisted sources before any map lookup.
Coexistence
The private-NIC (netns) topology lets OpenShield share a box with other filters, proxies and firewalls already in place.
Lean by design
Maps are sized and disciplined per host; LRU structures self-clean under flood so the operator never babysits them.
Silent features
The parts nobody advertises but everybody relies on.
Ban tiers that outlast the flood
Repeat offenders get pinned, never evicted by flood churn — LRU for the crowd, pinned for the worst.
Protected-source freezing
Proven clients are frozen mid-attack: existing sessions keep flowing while everything new must prove itself.
Per-destination analysis
On hosts with many IPs, it tracks per-IP attack state and can blackhole just the targeted tenant.
Egress policer (opt-in)
A TC egress twin caps outbound per source IP so one compromised VM can't get the host null-routed.