High-Speed eBPF/XDP Packet Filtering for Linux Server DDoS Mitigation

1. Understanding XDP Architecture vs Traditional Linux SKB Allocation

Standard Linux network processing allocates a complex kernel socket buffer data structure (sk_buff) for every incoming packet before firewall rules (iptables/nftables) can evaluate the packet.

Under volumetric DDoS attacks (such as 10 Million Packets Per Second UDP floods), the CPU time spent allocating and freeing sk_buff structures exhausts kernel memory and CPU cache lines, causing severe packet drops and server unresponsiveness.

eXpress Data Path (XDP) provides a high-performance bare-metal packet processing framework. XDP programs execute eBPF bytecode directly inside the network driver's RX ring buffer before sk_buff memory allocation occurs.

# Inspect network interface driver XDP support
ip link show eth0

2. XDP Packet Processing Actions (XDP_DROP vs XDP_PASS)

An XDP program evaluates raw packet data directly from driver memory and returns one of five verdict codes to the network card driver:

XDP_DROP: Immediately recycles the packet buffer in the driver RX ring without allocating memory or notifying the CPU TCP/IP stack.

XDP_PASS: Passes the packet up to the normal Linux TCP/IP network stack for standard processing.

XDP_TX: Bounces the packet back out the same network interface it arrived on (useful for high-speed load balancers).

// XDP Action Constants
// XDP_DROP = 1
// XDP_PASS = 2
// XDP_TX   = 3

3. Writing a Production XDP Packet Filter in C

XDP C code uses eBPF helpers and header pointers to parse Ethernet, IPv4, and UDP/TCP protocol headers safely.

The eBPF verifier verifies memory bounds checking before loading bytecode into the kernel, ensuring the XDP program can never crash the Linux kernel.

The following C program parses incoming IPv4 headers and drops packets matching blacklisted source IP addresses stored in an eBPF hash map:

#include 
#include 
#include 
#include 

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 100000);
    __type(key, __be32);
    __type(value, __u64);
} blacklist SEC("maps");

SEC("xdp")
int xdp_firewall(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    struct ethhdr *eth = data;
    
    if ((void *)(eth + 1) > data_end) return XDP_PASS;
    if (eth->h_proto != __constant_htons(ETH_P_IP)) return XDP_PASS;
    
    struct iphdr *iph = (void *)(eth + 1);
    if ((void *)(iph + 1) > data_end) return XDP_PASS;
    
    __be32 src_ip = iph->saddr;
    __u64 *value = bpf_map_lookup_elem(&blacklist, &src_ip);
    if (value) {
        return XDP_DROP;
    }
    return XDP_PASS;
}
char _license[] SEC("license") = "GPL";

4. Compiling & Loading Bytecode Targets via Clang/LLVM

Compile XDP C code into BPF Executable and Linkable Format (ELF) targets using Clang and LLVM compiler toolchains.

Attach the compiled BPF bytecode to a network interface using standard iproute2 ip link commands.

# Compile C code to BPF bytecode
clang -O2 -target bpf -c xdp_firewall.c -o xdp_firewall.o

# Attach XDP program to eth0 network interface
ip link set dev eth0 xdp obj xdp_firewall.o sec xdp

# Detach XDP program from eth0
ip link set dev eth0 xdp off

5. Dynamic Blocklist Management via BPF Maps

BPF Maps are high-speed shared memory structures bridging kernel space and user-space daemons.

User-space monitoring daemons (such as Fail2ban or custom Go/Python agents) populate blocked IP addresses into the BPF map dynamically without reloading the XDP program.

# Add blocked IP (e.g. 198.51.100.45) to BPF map via bpftool
bpftool map update id 4 key 198 51 100 45 value 1 0 0 0 0 0 0 0

# Dump current BPF map contents
bpftool map dump id 4

6. High-Throughput Packet Benchmark Verification

Verify XDP packet drop counters using ethtool or bpftool stats.

Benchmark packet processing throughput under simulated UDP floods using pktgen.

# Inspect XDP active interface stats
ip -s link show dev eth0

# View eBPF program list
bpftool prog show

Written by Zyekh Abdul Qadir Jailani

Digital Forensics & Incident Response (DFIR) Specialist & Security Researcher specializing in Linux kernel hardening, threat hunting, and system security research.

LinkedIn • GitHub • Discord • Email • PGP Key