Raking the floods: my intern project using eBPF

What this post added

Introduced an open-source Go library, 'rakelimit', for UDP service flood mitigation. The framework utilizes eBPF socket filters to analyze traffic patterns, employing hierarchical heavy hitters and CountMin sketches to identify and rate-limit attack traffic based on source/destination addresses and ports. It addresses challenges of spoofed IPs and IPv6 scalability by using probabilistic algorithms and a two-dimensional hierarchical structure for addresses and ports. The implementation uses fixed-point arithmetic to overcome BPF's lack of floating-point support.