My VPS provider's entire IP range got DDoS'd. So I learned XDP
💥 The Incident A few days ago, someone decided to DDoS the entire IP range of my Hong Kong VPS provider. My machine had fail2ban running. It did its job — maybe a little too enthusiastically. Within minutes it had banned over 20,000 IPs, allocating memory for each rule until the box ran out of RAM entirely and triggered a kernel panic. The VPS went dark… Great… :/ So here’s the irony: fail2ban didn’t fail because it was badly configured. It failed because of a fundamental architectural problem. Every packet in a flood still has to be received by the kernel, handed up the networking stack, and then evaluated before fail2ban can react. Under a real volumetric flood, that cost alone — tens of thousands of soft interrupts per second — is enough to saturate a single vCPU and collapse the machine before any rule can take effect. ...