DDoS data-plane lab M1a: traffic-generation foundation (blackwall-trafficgen) #61

New issue

Closed

opened 2026-06-30 01:58:08 +00:00 by vxfemboy · 1 comment

vxfemboy commented

2026-06-30 01:58:08 +00:00

(Migrated from github.com)

First increment of a new DDoS data-plane lab sub-project (Layer I from the traffic-gen research). A netns Rust traffic generator + per-flow measurement that floods a target with a full DDoS pattern set and verifies delivery — the substrate later increments (drive the real flow detector; drive nft-deception under load) and sub-project B's XDP testing reuse.

Scope

New blackwall-trafficgen crate (pure-core/thin-IO): pattern builders (UDP flood, TCP SYN flood w/ spoofed sources, DNS/NTP reflection, malformed, benign), token-bucket pacer, per-flow classifier, JSON reports, and the full-set spec + gate thresholds.
Thin AF_PACKET send/recv I/O (socket2 + libc sockaddr_ll); a trafficgen CLI (send/recv/verify).
A trafficgen-foundation lab scenario + a sixth CI lab gate.

Out of scope (deferred)

Layer II (BPF_PROG_TEST_RUN + xdpcap) — co-builds with sub-project B (epic #5).
Increments 2/3 (drive the flow detector via an sFlow agent; drive nft-deception under load).

First increment of a new **DDoS data-plane lab** sub-project (Layer I from the traffic-gen research). A netns Rust traffic generator + per-flow measurement that floods a target with a full DDoS pattern set and verifies delivery — the substrate later increments (drive the real flow detector; drive nft-deception under load) and sub-project B's XDP testing reuse. ### Scope - New `blackwall-trafficgen` crate (pure-core/thin-IO): pattern builders (UDP flood, TCP SYN flood w/ spoofed sources, DNS/NTP reflection, malformed, benign), token-bucket pacer, per-flow classifier, JSON reports, and the `full-set` spec + gate thresholds. - Thin `AF_PACKET` send/recv I/O (`socket2` + `libc` `sockaddr_ll`); a `trafficgen` CLI (`send`/`recv`/`verify`). - A `trafficgen-foundation` lab scenario + a sixth CI lab gate. ### Out of scope (deferred) - Layer II (`BPF_PROG_TEST_RUN` + xdpcap) — co-builds with sub-project B (epic #5). - Increments 2/3 (drive the flow detector via an sFlow agent; drive nft-deception under load).

vxfemboy commented

2026-07-03 10:12:37 +00:00

(Migrated from github.com)

Shipped — merged to main; its lab gate is green in CI (part of the blackwall-lab netns harness). Closing as complete.

Shipped — merged to `main`; its lab gate is green in CI (part of the `blackwall-lab` netns harness). Closing as complete.