DDoS Protection. AxisShield
AxisShield
XDP/eBPF high-performance DDoS scrubbing engine
AxisShield is AxisNetworks' proprietary, in-house DDoS mitigation engine, built on Linux XDP (eXpress Data Path) and eBPF. It intercepts and filters malicious traffic at kernel-bypass speed, before packets ever reach userspace. AxisShield is the scrubbing technology behind AxisNetworks Remote DDoS Mitigation, delivering transparent, BGP-based protection with a response time under 2 seconds and zero IP changes on the customer side.
<1µs
Latency per packet
25 Mpps
Throughput on 25GbE
<2s
Attack to mitigation
1M+
IP blacklist entries
65K
Prefix LPM entries
Architecture & Packet Processing Pipeline
AxisShield hooks into the Linux kernel at the XDP attach point: the earliest possible interception layer, executing at the NIC driver level, before any kernel memory allocation. eBPF programs, compiled from C, are loaded and pinned at startup. All filtering rules live in BPF maps, enabling zero-downtime live rule updates from the Go control plane.
Packet processing pipeline. Malicious packets are dropped at XDP, before they reach the kernel stack.
BGP Traffic Redirection
Customer prefix announced from AS209675 at ColoCenter Zoetermeer. Inbound traffic is pulled to the scrubber within roughly 30 seconds of BGP convergence.
- Transit: ColoCenter, Vultr & InterEdge
- IXP: INTERIX (around 41 peers)
- AS-path prepending on fallback routes
XDP Kernel-Bypass Filtering
eBPF programs execute at the XDP hook. Decisions: XDP_DROP (malicious, zero CPU cost), XDP_PASS (clean, to the kernel stack), XDP_REDIRECT (direct to the WireGuard return path).
- No sk_buff allocation for dropped packets
- O(1) BPF hash map lookup
- Atomic map update: zero packet loss
Clean Traffic Return
Scrubbed traffic is returned to the customer origin via an encrypted WireGuard tunnel. The customer's IP prefix stays unchanged. No DNS or routing changes required on the customer side.
- WireGuard, Curve25519 encryption
- GRE-in-WireGuard tunnel option
- Customer sees zero IP changes
Filter Layers
IP Blacklisting
BPF hash map, single IPs and CIDR prefixes. BGP FlowSpec rules inject directly into the map.
Prefix Matching (LPM)
BPF LPM trie, longest prefix match, up to 65,536 CIDR entries. Sub-millisecond lookup.
Protocol Enforcement
TCP/UDP/ICMP filtering. Port allow/deny lists. TCP flag validation drops SYN flood, ACK flood, XMAS, NULL.
Per-IP Rate Limiting
Token bucket rate limiter in eBPF per source IP. Excess packets are XDP_DROPped before kernel entry.
GeoIP Blocking
Country-level blocking via a BPF map populated from a GeoIP database. Regional attack suppression.
DNS Amplification
Payload inspection for DNS reflection, ANY queries, monlist. Drops amplified responses at wire speed.
NTP / SSDP / Memcached
Amplification vector blocking by payload signature. Reflection traffic identified and dropped.
Allowlist / Bypass
Customer-defined allowlists bypass all filter stages atomically. Critical upstreams are never blocked.
Go Control Plane
The Go control plane manages the eBPF program lifecycle, BPF map updates, BGP sessions, and WireGuard tunnel automation. It exposes a REST API and CLI for rule management and integrates with Prometheus for real-time metrics and automated mitigation triggers.
Key Go Packages
- cilium/ebpf: eBPF load, BPF map CRUD
- osrg/gobgp: BGP session, prefix announce/withdraw
- zx2c4/wireguard: WireGuard tunnel lifecycle
- prometheus/client_golang: metrics endpoint
- net/http: REST API, HMAC-SHA256 signed
Control Plane Features
- eBPF programs loaded and pinned at startup, auto-reload on crash
- Rule hot-reload: atomic BPF map update, zero packet loss
- REST API: rule CRUD, stats, tunnel management, GeoIP refresh
- Prometheus on :9100/metrics: pps, drop rate, active rules
- GoBGP: announces prefix on attack start, withdraws on all-clear
- Full automation: Prometheus alert to webhook to BGP to XDP active within 2s
- CLI: axisshield rules add, stats, bgp status, tunnel list
Performance Benchmarks
Benchmarks on a single EPYC core, dual-port 25GbE Mellanox ConnectX-6 Dx in XDP native mode. XDP offload mode (NIC-side execution) is under evaluation for the Brussels PoP.
| Metric | Target / Measured | Mode | Notes |
|---|---|---|---|
| Throughput, XDP_DROP | 25 Mpps / 25 GbE line rate | XDP Native | Single EPYC core |
| Throughput, XDP_PASS | 14 Mpps | XDP Native | With BPF map lookup overhead |
| Latency per packet | < 1 µs | XDP Native | No sk_buff allocation |
| BPF map lookup | < 100 ns | Hash O(1) | Per-packet rule check |
| Rule update latency | < 1 ms | Atomic update | Zero packet loss during update |
| IP blacklist capacity | 1,000,000+ entries | BPF hash map | Kernel-limited |
| Prefix match capacity | 65,536 entries | BPF LPM trie | IPv4 + IPv6 |
| Attack to mitigation | < 2 seconds | End-to-end | Prometheus alert to GoBGP to XDP |
| BGP convergence | around 30 seconds | BGP | Transit + IXP propagation |
Attack Coverage Matrix
Volumetric
- TCP SYN Flood
- UDP Flood
- ICMP Flood
- ACK Flood
- PSH Flood
- IP Fragmentation
- Ping of Death
- TTL Exceeded
Reflective & Amplification
- NTP Monlist
- DNS Amplification
- SSDP/UPnP
- SNMP Reflection
- Chargen
- Smurf
- Fraggle
- Memcached
- RIP / TFTP
Resource Exhaustion
- Malformed Packets
- Bad Checksums
- IP Fragmentation
- Invalid TCP Seg ID
- Illegal TCP/UDP Flags
- Invalid Ports
- Reserved IP
Protocol / App Layer
- A2S Source Flood
- FiveM / RakNet
- RTFM Request
- TS3INIT
- NetBIOS
- Minecraft
- Rust
- A2S GETSUM
- HTTP Flood
Coverage reflects current and in-progress AxisShield filter modules. L7 vectors are under active development.
Security & Compliance
API & Control Plane
- HMAC-SHA256 request signing on all REST endpoints
- bcrypt password hashing (security audit v0.2)
- CSRF tokens on all state-changing operations
- Rate limiting on the API, brute-force protection
- TLS 1.3 only on management interfaces
Kernel & Network
- eBPF verifier: kernel safety guaranteed, no arbitrary execution
- WireGuard Curve25519: clean-traffic tunnels encrypted in transit
- AxisNetworks is an NCSC-NL member, GDPR Article 33 incident reporting
- Proxmox cluster on an isolated VLAN, management traffic segmented
- Stateless packet processing, no customer data stored
Development Roadmap
| Version | Feature / Milestone | Status |
|---|---|---|
| v0.1 | XDP_DROP / XDP_PASS: IP filter via BPF hash map | Active |
| v0.2 | BPF map rule management + Go CLI + security audit (bcrypt, HMAC-SHA256, CSRF) | Active |
| v0.3 | Prometheus metrics endpoint + Grafana real-time dashboard | Active |
| v0.4 | Per-source-IP token bucket rate limiter in eBPF | Active |
| v0.5 | GoBGP integration: automated prefix announce/withdraw on attack trigger | Active |
| v0.6 | WireGuard return-path tunnel automation per customer | Active |
| v1.0 | Production release: AxisNetworks SLA-backed service | Active |
| v1.1 | Multi-region scrubbing live: Amsterdam, Frankfurt & London | Active |
| v1.x | L7 DNS/NTP amplification detection: payload inspection | In Development |
| v2.0 | Extra PoPs: Paris & Barcelona (multi-region scrubbing expanded) | Planned |
Built In-House
AxisShield is developed entirely in-house by the AxisNetworks team, from kernel code to control plane.
Jelle Hofstee, Founder & Director
AxisShield is proprietary software. White-label, OEM and partnership enquiries are welcome.
Want to protect your network with AxisShield?
Contact us to discuss how Remote DDoS Mitigation, powered by AxisShield, fits your infrastructure.
Contact UsTransform your IT infrastructure with AxisNetworks
Work with a Dutch partner that runs its own network and datacenter. Cybersecurity, cloud and network management under one roof. One point of contact, one invoice.