Where moat sits, and why it is cheap there.

Follow a packet from the wire to the application. Scroll, and the line stops at each station it passes.

  • traffic
  • flood, dropped by moat
  • rejected by stateful rules
arrived
0
dropped by moat at XDP
0 0%
dropped by netfilter
0
reached the app
0

  1. The path

    Every packet takes the same road.

    A packet that reaches a Linux server passes the network card, the driver, the kernel network stack and a socket before an application reads it. Every step costs work. moat stands at the first one the kernel offers.

  2. 01 · network card

    It arrives on the wire.

    The card writes each packet into a receive ring in memory, one slot at a time, and the driver picks it up from there. Nothing has been decided about it yet, and nothing has been spent on it.

  3. 02 · XDP

    moat decides before the kernel does.

    XDP is a hook in the driver that runs a BPF program on each packet before the kernel builds anything for it. moat compiles your rules into that program. Flood packets are dropped here, in tens to hundreds of nanoseconds, and cost nothing more.

  4. 03 · socket buffer

    The kernel wraps what passed.

    For every packet that gets through, the kernel allocates a socket buffer, the sk_buff that carries it up the stack. This is the work a flood forces on a server, and the work moat saves for every packet it drops.

  5. 04 · netfilter

    Your firewall keeps the last word.

    iptables or nftables run here, with connection tracking: established connections, NAT, forwarding and logging. Packets their stateful rules reject are dropped here too, but only after the kernel has built a socket buffer for each. moat keeps no state, so it works in front of them, cutting the volume they see.

  6. 05 · socket

    Clean traffic reaches the application.

    The packet lands in a socket queue and the application reads it. Under a flood, the queue keeps moving because most of the flood never got past the card.

moat in front, your firewall behind.

Drop floods and bogus sources at XDP with rules you can read and test, and let iptables or nftables keep what needs state.

Install moat Compare with iptables and nftables