Tempesta xFW: open-source eBPF-based volumetric DDoS protection#

Alexander Krizhanovsky

Why: A rare open-source, architecture-level treatment of volumetric DDoS filtering in XDP/tc, including the parts that usually stay proprietary: rate-limiter design trade-offs, and what current eBPF API limits actually prevent.

What: An open-source eBPF DDoS mitigation stack covering both host-based deployment (CDN edge, on-prem ADC, where the host terminates TCP) and router-based deployment (ISP/hosting/IaaS, where the host may only ever see attack traffic or one direction of it, as in DSR and scrubbing).

How: A multi-layer filter — source port/address filtering, reputation and GeoIP, IP/UDP/TCP anomaly checks, destination-IP rate limiting as last resort — with XDP and tc programs arranged for multi-NIC nodes. The talk compares leaky buckets, sliding windows and probabilistic rate limiting and the configuration hazards of each; covers TCP authentication for ACK/RST floods and SYN-flood protection across host, router and scrubbing scenarios; DNS-specific parsing and acceleration; Prometheus metrics with per-CPU high-throughput incident logging to ClickHouse (sampled under overload); and an evaluation mode for safe deployment. Notes that most filtering logic turns out to be shared across the deployment architectures. (From abstract only.)

Where applicable: Broadly deployable open source (repo, full release scheduled June 2026), from single hosts to scrubbing centres. It is the vendor's own project, so treat performance claims accordingly.