Linux eBPF & XDP Packet Filtering: Mitigating Multi-Gigabit DDoS Attacks at Layer 2/3

Traditional Linux firewall software (such as iptables or nftables) processes packets after the kernel allocates a sk_buff data structure and triggers hardware interrupts. Under volumetric DDoS attacks exceeding 2 million packets per second (Mpps), kernel memory allocation bottlenecks and softirq CPU saturation crash the operating system before a single firewall rule executes. By attaching eBPF programs directly to the eXpress Data Path (XDP) inside the network interface card (NIC) driver, engineers drop malicious packets at wire-speed with zero kernel overhead.

The Architecture of eXpress Data Path (XDP)

XDP executes verified C bytecode at the lowest possible layer in the Linux network subsystem—immediately upon DMA packet reception from the network card ring buffer:

Performance Benchmark: iptables vs nftables vs XDP

Sample eBPF XDP Packet Filter in C

Compile and attach this minimal eBPF program to discard unauthenticated UDP amplification traffic:

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <bpf/bpf_helpers.h>
SEC("xdp")
int xdp_ddos_filter(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_PASS;
    if (eth->h_proto != __constant_htons(ETH_P_IP)) return XDP_PASS;
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_PASS;
    if (ip->protocol == IPPROTO_UDP && ip->daddr == 0x010B0AA8) { // Target IP
        return XDP_DROP;
    }
    return XDP_PASS;
}
char _license[] SEC("license") = "GPL";

Deploy Resilient Cloud Infrastructure with WinWinHost

Protect your production web applications against DDoS attacks with enterprise hosting. Review our guide on Nginx Dynamic Microcaching, inspect multi-tenant hosting at WebDesigner.LA Multi-Tenant Engineering, review real-time push streaming at CreativeWebProgramming, or contact our cloud security specialists.