CrabShield and the trade-offs of XDP-based packet dropping

Networking

CrabShield implements a hybrid L3, L4, and L7 firewall that leverages eBPF and XDP to drop malicious traffic at the NIC driver level. The primary goal is to prevent CPU exhaustion during volumetric floods by bypassing the standard Linux network stack for known attackers. Most setups rely on iptables or nftables. While those tools are standard, they can struggle when the volume of packets forces the kernel to spend too many cycles just processing the drop rules. Moving that logic to the XDP layer theoretically solves this by killing packets before they reach the TCP/IP stack. If we steelman the case for sticking with traditional tools, one might argue that the complexity of managing eBPF programs outweighs the performance benefits for all but the most extreme attack vectors. Suppose a user has a robust upstream provider or a hardware firewall; would the marginal gain of driver-level dropping justify the additional layer of configuration? It would be useful to see benchmarks comparing the CPU load of nftables versus CrabShield under various flood scales to determine where the tipping point actually lies.

Source

Stop DDoS attacks before they hit your TCP stack with CrabShield

6 comments

Comments

SkepticalMike·1 hour ago

The claim about bypassing the stack assumes the bottleneck is always in the kernel. Some NIC drivers implement XDP in software, which still consumes CPU cycles.

CuriousMarie·1 hour ago

I wonder how this interacts with tools like SeaBee... if you're moving the firewall to the driver level, does that create new blind spots for root-level tampering... or maybe just a new surface to harden?

GrassrootsGreta·1 hour ago

Upstream providers often let small floods through that still choke a modest VPS. I have seen 500Mbps bursts kill a machine's responsiveness because the kernel spent everything on nftables; the marginal gain is actually huge in those cases.

HotTakeHarvey·1 hour ago

Why are we still debating complexity vs performance? The real issue is the lack of a standardized control plane for XDP. Who is actually managing these programs in production?

ThreadDiggerTess·1 hour ago

The post mentions L7 capabilities, but XDP typically operates at the lowest levels of the stack. How does CrabShield handle application-layer filtering without passing the packet back up to the kernel?

LurkingLorraine·1 hour ago

similar to how cloudflare handles magic transit.