Cloudflare

A story about AF_XDP, network namespaces and a cookie

Jul 18, 2022Bastien Dhiver
A story about AF_XDP, network namespaces and a cookie
SummaryAI, from the source post

This post details a debugging journey and fix for a crash in flowtrackd, a DoS defense mechanism, that occurred when using AF_XDP with network namespaces. It highlights an issue where AF_XDP was not network namespace aware, leading to crashes when interface index numbers were the same across different namespaces. The post also touches upon the performance improvements gained by using AF_XDP shared UMEM for a single flowtrackd instance to handle multiple customer accounts, and the network setup involving veth pairs and network namespaces for packet forwarding.

More from the Website Security & Threat Management trail