Strenox DDoS Migration

XDP-Based DDoS Mitigation Firewall by StrenoxDevelopment

Strenox DDoS Migration attaches to a network interface at the earliest possible point in the Linux networking stack and makes drop/pass decisions before the kernel allocates an SKB. Target: 10M+ packets per second on a single core with sub-microsecond per-packet overhead.

Features

• XDP-native: Line-rate packet processing at the driver level
• Multi-vector detection: SYN flood, UDP flood, ICMP flood, amplification, L7 signatures
• Behavioral analysis: EMA-based baseline learning, bot cluster detection
• Auto-escalation: 6-level star system with subnet bans
• Panic circuit breaker: Per-CPU probabilistic bulk drop
• SYNPROXY: Scalar SYN flood mitigation at XDP line rate
• Geo-blocking: MaxMind GeoIP2 database support
• Blocklist auto-fetch: Public blocklist URL fetching
• Real-time TUI: 7-screen dashboard with live charts
• Metrics API: Prometheus-compatible JSON endpoint
• Alerts: Discord and Slack webhooks
• Forensics: Attack bundles with config snapshots

Quick Start

Prerequisites

• Linux kernel 5.10+ with BPF/XDP support
• clang/llvm 12+
• bpftool
• Go 1.22+
• libbpf-dev

Build

# Clone the repository
git clone https://github.com/StrenoxDevelopment/strenox-migration.git
cd strenox-migration

# Build everything
make all

# Or use the build script
./scripts/build.sh

Install

sudo make install

Configure

Edit /etc/strenox/strenox.toml:

[general]
interface = "eth0"
mode = "active"
log_level = "info"

[detection]
rate_limit_pps = 10000
syn_pps_threshold = 5000

Run

# Start the firewall
sudo strenox start

# Check status
sudo strenox status

# View statistics
sudo strenox stats

# Launch TUI dashboard
sudo strenox tui

# Stop
sudo strenox stop

CLI Commands

Command	Description
strenox start	Start the XDP firewall
strenox stop	Stop the firewall
strenox status	Show current status
strenox ban <ip>	Ban an IP address
strenox unban <ip>	Unban an IP address
strenox whitelist <ip>	Whitelist an IP
strenox unwhitelist <ip>	Remove from whitelist
strenox stats	Show statistics
strenox reload	Hot-reload config
strenox tui	Launch TUI dashboard
strenox export-signatures	Export L7 signatures
strenox import-signatures <file>	Import L7 signatures

Architecture

XDP Pipeline (16 stages)

1. Parse Ethernet header
2. Parse IP header (IPv4/IPv6)
3. Bogon filter (RFC1918, loopback, multicast, reserved)
4. Fragment drop
5. L4 parse (TCP/UDP/ICMP)
6. TCP flag validation
7. Whitelist check (Bloom filter + hash)
8. Ban check (hash + LPM trie)
9. Rate scoring (per-IP PPS/BPS/protocol)
10. Connection tracking (blind SYN-ACK/RST)
11. Amplification detection (DNS/NTP/SSDP/Memcached)
12. L7 signature match (16-slot mask-and-compare)
13. Behavior engine (baseline + cluster detection)
14. Attack mode check
15. Panic circuit breaker
16. Pass/Drop decision

BPF Maps

Map	Type	Purpose
config_map	ARRAY	Runtime configuration
ip_stats_map	LRU_HASH	Per-IP statistics
ban_map	LRU_HASH	Active bans
subnet_ban_map	LPM_TRIE	Subnet bans
whitelist_map	HASH	Whitelisted IPs
global_stats_map	PERCPU_ARRAY	Global counters
baseline_map	ARRAY	Behavior baseline
events_map	RINGBUF	Userspace events
l7_sig_map	ARRAY	L7 signatures
bloom_map	ARRAY	Bloom filter
panic_bucket_map	PERCPU_ARRAY	Panic state
prefix_ban_map	LRU_HASH	Prefix ban counters
new_source_map	ARRAY	New source tracking

Testing

# Unit tests
go test -race ./...

# Integration tests (requires root)
sudo go test -tags=integration ./test/integration/...

# Attack simulation
sudo ./scripts/test-attack.sh 127.0.0.1 80 lo

License

MIT License — see LICENSE for details.

Credits

Built with ❤️ by StrenoxDevelopment