eBPF XDP Packet Filter Evaluator

Interactive eBPF XDP kernel network packet filtering & DDoS mitigation simulator. Test XDP_DROP vs XDP_PASS decisions at line-rate without kernel compilation.

[ CONFIG ] eBPF Map & Rule Filter

DDoS Attack Intensity (PPS): 1,500,000 pps
Simulated packet rate arriving at NIC RX queue.

[ DECISION MATRIX ] Kernel Processing

XDP_DROP (Mitigated)
14 pkts
XDP_PASS (To TCP/IP Stack)
6 pkts
CPU Stack Savings
98.2%
NIC Line Rate
14.8M pps

[ KERNEL XDP LOG STREAM ]

[ ARCHITECTURE ] eBPF XDP vs iptables Architecture

eBPF XDP (eXpress Data Path) executes BPF bytecode directly inside the network interface card (NIC) driver before socket buffer (`sk_buff`) memory allocation occurs. This enables line-rate packet drops without involving the Linux kernel TCP/IP stack.

Action Codes & Performance Characteristics

  • XDP_DROP: Drops packet immediately at driver layer. Consumes 0 CPU memory allocation in network stack.
  • XDP_PASS: Passes packet to standard Linux networking stack (`netif_receive_skb`).
  • XDP_TX: Bounces packet back out of the same interface (useful for hairpin load balancing).