Performance Benchmarks

Real-world flood protection analysis for LiteShield XDP. Tested on kernel 7.0, x86_64, generic XDP mode, veth pair at 10Gbps.

• Test Environment
• Benchmark Results
  • SYN Flood
  • UDP Flood
  • ICMP Flood
  • Mixed Flood (SYN + UDP + ICMP)
  • Multi-Source Flood (Random IPs)
• CPU Usage
• Performance Analysis
  • Throughput Summary
  • Defense Mechanism Breakdown
  • Scaling Characteristics
• Comparison with Other XDP Firewalls
• Tuning for Your Environment
  • High-Traffic Server (10+ Gbps)
  • VPS / Shared Hosting (1 Gbps)
  • Home Server / Low Traffic
• Known Limitations
• Conclusion

---

Test Environment

Component	Specification
Kernel	7.0.0-28-generic
CPU	x86_64 (multi-core)
XDP Mode	Generic (SKB)
Test Interface	veth pair (10Gbps)
Traffic Generator	hping3 --flood mode
Test Duration	10 seconds per flood type

Note on XDP Mode

Generic (SKB) mode is used for maximum compatibility. Native (driver) mode is typically 2-3× faster on supported NICs.

---

Benchmark Results

SYN Flood

Attack: TCP SYN packets to port 80 at maximum rate.

Metric	Value
Packets Received	2,075,377
Packets Passed	18,523
Packets Dropped	2,056,854
Drop Rate	99.11%
SYN Rule Drops	5
Ban Drops	2,056,849
Effective PPS	~207,000

Analysis: The source IP exceeded the SYN threshold within the first second and was auto-banned. All subsequent packets were dropped at the ban check. The 5 SYN drops represent the initial packets that triggered the threshold before the ban took effect.

---

UDP Flood

Attack: UDP packets to port 53 at maximum rate.

Metric	Value
Packets Received	4,058,755
Packets Passed	38,911
Packets Dropped	4,019,844
Drop Rate	99.04%
UDP Rule Drops	5
Ban Drops	4,019,834
Effective PPS	~405,000

Analysis: Same pattern as SYN flood — threshold hit immediately, IP banned, remaining packets dropped. UDP floods are handled at slightly higher rates due to smaller packet size (28 bytes vs 40 bytes for TCP).

---

ICMP Flood

Attack: ICMP echo requests at maximum rate.

Metric	Value
Packets Received	5,995,515
Packets Passed	42,919
Packets Dropped	5,952,596
Drop Rate	99.28%
ICMP Rule Drops	8
Ban Drops	5,952,578
Effective PPS	~599,000

Analysis: ICMP floods achieve the highest packet rates due to minimal packet size and no connection state. The firewall maintained full drop rate without any performance degradation.

---

Mixed Flood (SYN + UDP + ICMP)

Attack: Simultaneous SYN, UDP, and ICMP floods from the same source.

Metric	Value
Packets Received	11,768,696
Packets Passed	61,335
Packets Dropped	11,707,361
Drop Rate	99.48%
SYN Drops	10
UDP Drops	7
ICMP Drops	12
Ban Drops	11,707,332
Effective PPS	~1,176,000

Analysis: The firewall handled over 1.1 million packets per second from a single source with 99.48% drop rate. All three protocols were tracked independently — the source was banned after exceeding multiple thresholds simultaneously.

---

Multi-Source Flood (Random IPs)

Attack: hping3 --rand-source generating packets from random IPs.

Metric	Value
Packets Received	1,009,835
Packets Passed	241
Packets Dropped	1,009,594
Drop Rate	99.98%
New-Source Drops	1,009,594
Ban Drops	0
Effective PPS	~201,000

Analysis: The global new-source limiter (10 new IPs/sec) was the primary defense. Random IPs couldn't establish per-IP state fast enough to trigger individual bans, so the global limiter caught them. Only 241 packets from the first few IPs passed before the limiter engaged.

---

CPU Usage

Scenario	CPU %	Memory
Idle	0.0%	0.3%
SYN Flood	0.0%	0.3%
UDP Flood	0.0%	0.3%
ICMP Flood	0.0%	0.3%
Mixed Flood	0.0%	0.3%

Why is CPU usage zero?

XDP programs run in kernel space, not in the loader process. The loader (liteshield) only attaches the program and exits. All packet processing happens in the kernel's XDP hook, which is why userspace CPU usage is negligible even under million-PPS floods.

---

Performance Analysis

Throughput Summary

Flood Type	PPS Handled	Drop Rate	Primary Defense
SYN Flood	~207,000	99.11%	Auto-ban
UDP Flood	~405,000	99.04%	Auto-ban
ICMP Flood	~599,000	99.28%	Auto-ban
Mixed Flood	~1,176,000	99.48%	Auto-ban
Random IP Flood	~201,000	99.98%	New-source limiter

Defense Mechanism Breakdown

Mechanism	When It Triggers	Effectiveness
Per-IP Rate Limits	Single IP exceeds PPS/SYN/UDP/ICMP threshold	Immediate (1s window)
Auto-Ban	After rate limit violation	Blocks all subsequent packets from that IP
New-Source Limiter	Global new IPs/sec exceeded	Blocks packets from IPs not seen before
Flow Rate Limits	Per-flow (src+dst+proto+ports) PPS/BPS exceeded	Blocks specific high-rate flows
Blacklist	Manual ban added	Immediate permanent/timed block
Whitelist	IP in whitelist	Bypasses all checks
Blackhole	Activated manually	Blocks all new IPs, preserves existing

Scaling Characteristics

Single IP flood:     PPS limited by per-IP threshold → auto-ban
Multi-IP flood:      PPS limited by new-source limiter → global block
Legitimate traffic:  No impact (below thresholds)

---

Comparison with Other XDP Firewalls

Feature	LiteShield XDP	gamemann/XDP-Firewall	OpenShield-XDP
Max PPS (generic)	~1.1M	~500K	~10M+
Max PPS (native)	~3M (est)	~1.5M	~30M+
Drop rate under flood	99.5%	95%	99.9%
CPU overhead	~0%	~0%	~0%
Memory footprint	8MB	5MB	50MB
Attack vectors	7	5	42

OpenShield-XDP Comparison

OpenShield-XDP is the commercial big brother with 42 detection vectors, baseline learning, and forensics. LiteShield is the free minimal alternative — 80% of the protection at 10% of the complexity.

---

Tuning for Your Environment

High-Traffic Server (10+ Gbps)

thresholds:
  pps: 1000000
  syn: 50000
  udp: 200000
  icmp: 10000
  new_src: 5000
  flow_pps: 100000
  flow_bps: 100000000

VPS / Shared Hosting (1 Gbps)

thresholds:
  pps: 200000
  syn: 10000
  udp: 50000
  icmp: 5000
  new_src: 1000
  flow_pps: 50000
  flow_bps: 50000000

Home Server / Low Traffic

thresholds:
  pps: 50000
  syn: 2000
  udp: 10000
  icmp: 1000
  new_src: 100
  flow_pps: 10000
  flow_bps: 10000000

---

Known Limitations

Per-CPU Maps

ip_stats_map, flow_stats_map, and new_src_map are per-CPU LRU hashes. Rate limits are approximate — a flood spread across many CPUs may appear under the per-CPU threshold while exceeding the global rate. This is a documented trade-off for lock-free performance.

Fragmented Packets

IP fragments pass without L4 rate accounting. The first fragment is rate-limited, but subsequent fragments of the same packet are not. This prevents fragment-based evasion but may allow small fragment floods.

Blackhole Mode

Blackhole mode blocks ALL new IPs. If activated without seeded admin IPs, you will be locked out. Always whitelist your SSH IP before activating.

---

Conclusion

LiteShield XDP handles over 1 million packets per second with 99.5% drop rate and zero userspace CPU overhead. It's suitable for:

• VPS and shared hosting under DDoS
• Game servers facing UDP floods
• Web servers facing SYN floods
• Any Linux server needing basic XDP protection

For advanced features (baseline learning, attack forensics, 42 detection vectors), upgrade to OpenShield-XDP.

---

Benchmarked by AnAverageBeing for PingLess Studios

Test methodology: hping3 --flood on veth pair, 10s per test, generic XDP mode. Results may vary based on hardware, kernel version, and NIC capabilities.