Other Packet filter vs nftables & Netmap vs eBPF XDP & dpdk?

[nikolqy]

I am trying to understand the pros/cons, use cases, performance etc. for packet filter, nftables, Netmap, ebpf xdp and dpdk. I am having trouble finding comparisons and benchmarks, so I’m curious if anyone here has hands on experience with some or all of these technologies that can share their knowledge.

I’m thinking of these technologies in the context of serving large websites and protecting them, whether it be from a DDoS attack or something else (network layer, of course.)


Correct me if I’m wrong, but FreeBSD packet filter is directly comparable to Linux nftables. According to some outdated benchmarks I found, nftables and packet filter have similar performance, but packet filter seems to have better performance when there are hundreds of rules. Will probably depend on what the rules are, but still, they generally seem to be equivalents in terms of performance.

Again, correct me if I’m wrong, FreeBSD Netmap is directly comparable to Linux eBPF XDP. They’re both used for packet manipulation in userspace (right?) and Netmap is older and superior in terms of performance and of course licensing where as eBPF XDP is new and still experimental, though companies like cloudflare are using it in production for their services, so it’s stable enoughhhhh…

And then DPDK. It works on Linux and FreeBSD. It allows users to run code directly on the network adapter hardware, which makes it the most efficient out of all of them, except it seems to be slightly limited in terms of functionality and is usually overkill, as Netmap/XDP do things efficiently enough and would be able to handle most things. (If you’re experiencing a DDoS, you can block with DPDK, but regardless, if your network ports are filled up, let’s say a 10Gbps port, whether you use dpdk or Netmap, people wont be able to access the server if the port is filled, right? Unless maybe the attack is millions of small packets per second, then maybe dpdk could handle with less stress?)

Anyways, sorry for any weird formatting (I’m on my phone right now) but I’d love to know more about these technologies.

 

[hardworkingnewbie]

Cloudflare is not the answer to whatever question, nor a solution, it's a whole plethora of problems by itself so just say no to it. And firewalls with hundreds of rules - yikes, ugly, error prone, debugging hell, shouldn't happen.

Aside that you should first name the problem(s) you want to solve in a quick manner, this would help understanding you a lot better when giving you answers.

 

[nikolqy]

Cloudflare is not the answer to whatever question, nor a solution, it's a whole plethora of problems by itself so just say no to it. And firewalls with hundreds of rules - yikes, ugly, error prone, debugging hell, shouldn't happen.

Aside that you should first name the problem(s) you want to solve in a quick manner, this would help understanding you a lot better when giving you answers.

I agree, cloudflare is a mess. I was really curious if a company could build a robust content delivery network with good network layer anti-DDoS protection with FreeBSD’s netmap, or if that would be the wrong tool. If it would work, then I can’t imagine why cdns aren’t using FreeBSD.


According to Netflix, content caching is best done with nginx on FreeBSD, but it only really works if you offload TLS to hardware, use sendfile (2?) bbr (2?) and other enhancements, and that seems to be for large video segments sent over http/1.1 TLS connections, not your average web content.

I feel like a FreeBSD server running a netmap firewall program and haproxy that load balances to backend caches would work. I’m trying to benchmark different setups like haproxy -> squid, nginx, nginx -> nginx etc. but it’s super complicated because there is absolutely positively no information whatsoever about any technicalities for FreeBSD, Squid, HAProxy and nginx. Like I don’t know if using zfs makes a difference, I don’t know if sendfile exists for software other than nginx, whether or not bbr actually works properly on FreeBSD, if aio is helping or hurting any setups etc. Netflix says aio is bad for nginx but you only get these snippets from companies that reveal a single detail about their infrastructure but nothing else.

 

[SirDice]

When you're on the butt end of a DDoS, no amount of firewalling on the receiving host is going to help you. Your upstream connection will be completely saturated. It's like a funnel that's overflowing because there's more going in than can flow out of the bottom.

 

[nikolqy]

When you're on the butt end of a DDoS, no amount of firewalling on the receiving host is going to help you. Your upstream connection will be completely saturated. It's like a funnel that's overflowing because there's more going in than can flow out of the bottom.

Yes, but sometimes DDoS attacks target the firewalls efficiency rather than simply contesting ports. Attacks that send millions of small packets per second might not fill a port, but instead exhaust the firewall.

I assume most DDoS/DoS attacks come from hosting providers. If OVH Canada is attacking Oracle Ashburn, and OVH uses AT&T for connectivity, only traffic coming through AT&T to Oracle Ashburn should be affected. It probably depends on where in the stack Oracle is blocking traffic at and whether or not their firewalls can handle millions of small packets or many oversized packets.

I am not really sure what mixture upstream/downstream/peering setups have on this though.