A story about AF_XDP, network namespaces and a cookie
Jul 18, 2022Bastien Dhiver

Summary
This post details a debugging journey and fix for a crash in flowtrackd, a DoS defense mechanism, that occurred when using AF_XDP with network namespaces. It highlights an issue where AF_XDP was not network namespace aware, leading to crashes when interface index numbers were the same across different namespaces. The post also touches upon the performance improvements gained by using AF_XDP shared UMEM for a single flowtrackd instance to handle multiple customer accounts, and the network setup involving veth pairs and network namespaces for packet forwarding.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack