DDoS Protection

Tempesta xFW uses Linux eBPF programs, which undergo strict kernel verification and provide high reliability with years of uptime. Tempesta xFW has been proven in production for volumetric DDoS protection.

A typical alternative to eBPF is DPDK, including VPP. These are user-space C/C++ applications that may crash because of software bugs, leading to loss of protection or even failure of the entire data plane.

Tempesta xFW works on standard x86-64 servers and supports multi-port 200Gbps and higher NVIDIA or Intel adapters. CPU and power consumption scale with traffic volume, and you can run other applications, such as HTTP or DNS servers, on the same host as Tempesta xFW.

This differs from DPDK-based approaches, which may deliver higher peak performance but typically consume all available CPU resources and do not allow application services to run on the same host.

ECMP setups can be used to scale to 1 Tbps and beyond.

• It allows mitigation resources to be shared across multiple edges
• It reduces the blast radius for unaffected customers
• Filtering logic, even with no active rules, still adds some latency, whereas this approach adds no latency to normal traffic
• If the DDoS protection system fails for any reason, the main data plane continues to operate

Modern DDoS attacks, such as Aisuru-Kimwolf, can exploit this architecture with a hit-and-run strategy: the attack may last only for 20 to 60 seconds, leaving too little time for the detection system to apply rules and block it.

An inline always-on deployment may add unwanted packet-processing latency to normal traffic and is typically less cost-efficient than a redirection-based filtering architecture.

However, low detection latency is crucial for mitigating modern DDoS attacks. Inline always-on filtering can completely eliminate detection latency for some attack types, such as malformed-packet attacks, or reduce it to the millisecond range.

The drawback of this architecture is that false positives may affect legitimate traffic even when no attack is in progress.

Tempesta xFW can operate in a hybrid mode that combines the benefits of redirection and inline always-on architectures while reducing their drawbacks.

In this architecture, the base deployment is inline. Only a small subset of reliable rules, such as permissive rate limits, is enabled in always-on mode. These rules have almost no impact on packet-processing latency, while still filtering a large share of traffic from hyper-volumetric attacks.

A more advanced rules set, such as TCP anomaly filter, is enabled by a DDoS detection sensor and filters the remaining parasitic traffic that passes through the first layer of always-on rules.