What Is XDP DDoS Filtering? Line-Rate Protection Explained

XDP is one of the most powerful tools in modern DDoS defence — and the foundation of our in-house mitigation. Here is what it is, in plain terms, a real attack walked through, and why it stops floods that ordinary firewalls cannot.

What does XDP mean?

XDP stands for eXpress Data Path. It is a feature of the Linux kernel that lets you run a small filtering program (written with eBPF) at the very moment a network packet arrives on the card — before the operating system spends any effort processing it.

In plain terms: XDP inspects and drops bad packets at the earliest possible point, so junk traffic never makes it to your firewall, your CPU's network stack, or your game process.

XDP and eBPF: how they relate

eBPF is the underlying technology — a safe, sandboxed way to run small programs inside the Linux kernel without modifying kernel source code. XDP is one specific "hook point" for eBPF programs: the earliest point in a packet's journey, right as it leaves the network driver. Other eBPF hooks exist deeper in the network stack, but none run earlier than XDP, which is exactly what makes it so effective against floods.

Why "before the application" matters

A traditional firewall (iptables) sees a packet only after the kernel has already done a lot of work to track it. Under a flood of millions of packets per second, that work alone can pin your CPU at 100% and take the server down — even if every packet is ultimately dropped.

XDP avoids that. Because it runs at the driver level, it can discard a malicious packet in a handful of CPU cycles, sustaining millions of drops per second without melting the box.

A SYN flood, walked through

Take a classic SYN flood: an attacker sends a wave of connection requests that never complete, aiming to exhaust your server's connection table. A traditional firewall still has to allocate state for each half-open connection before it can decide what to do with it — under millions of packets per second, that bookkeeping alone can overwhelm the CPU. An XDP program, by contrast, can recognise the pattern and drop the packet before any connection state is ever created, so the flood never gets the chance to exhaust anything.

How XDP stops a DDoS

• Line-rate drop — bad packets are discarded as fast as the network card can receive them.
• Stateless filtering — no connection table to exhaust, so SYN and protocol floods lose their bite.
• Game-aware rules — only the ports and packet shapes a game actually uses are allowed through.
• CPU stays free — your server spends its cycles on the game, not on fighting traffic.

XDP vs a normal firewall

A firewall is great for ordinary rules but was never built for terabit floods. XDP is not a replacement for upstream network capacity — you still need a big pipe to absorb volumetric attacks — but it is the perfect last mile: a fast, programmable filter sitting right at the server, catching what slips through and shaping traffic exactly for the workload.

The trade-offs of XDP

XDP isn't magic — it has real limits. Rules have to be simple and fast, since anything too complex risks slowing down every packet, including legitimate ones. It also needs compatible network drivers and careful engineering to avoid false positives that drop real player traffic. That's why XDP works best as a precision tool paired with a large upstream network rather than the only line of defence — see DDoS attack vectors explained for the fuller picture of what it's defending against.

How ESAGAMES uses it

We pair a multi-Tbps Frankfurt network (to absorb the volume) with our own XDP layer (to filter with game-aware precision). That combination is why mitigation stays close to the server, latency stays low for players, and false positives stay rare. See the bigger picture in how our Anti-DDoS works.

Upstream capacity absorbs the flood; XDP at the edge of the server makes sure only real players get through.