[Backlog] Realistic DDoS-scale stress testing (DPDK/AF_XDP kernel-bypass, WARP17-class) #67

New issue

Open

opened 2026-07-01 01:06:56 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-07-01 01:06:56 +00:00

(Migrated from github.com)

Backlog / future direction — not scheduled.

The integration lab (netns, single host, userspace generators over a veth) is a correctness/integration lab: it validates behavior (does a mechanism engage correctly), not throughput ceilings. It cannot produce realistic DDoS scale (tens of thousands of conns/sec, real resource exhaustion, throughput/latency-at-scale).

A realistic stress/benchmark capability needs a different substrate:

Kernel-bypass traffic generation — DPDK or AF_XDP — to drive line-rate floods a userspace/veth generator can't (this is why WARP17 is DPDK-based and doesn't work in netns).
Likely dedicated hardware / dedicated NICs (or at least SR-IOV / a multi-host testbed), and measurement of throughput, latency-under-load, and resource exhaustion at scale.

This is coupled to the deferred DDoS-lab Layer II (XDP/eBPF data-plane testing) and to sub-project B (the XDP fast path) — both need the eBPF/XDP toolchain. Realistic stress testing is the natural companion to building the XDP mitigation.

Until then, deception/mitigation "under load" gates in the lab are explicitly resilience/correctness gates (e.g. drop-at-cap enforced, legit survives, no crash), not stress benchmarks.

Context: see the blackwall-trafficgen foundation (DDoS lab M1a, #61) and the ddos-lab-xdp-testing-research design notes. WARP17 reference: https://github.com/Juniper/warp17

**Backlog / future direction — not scheduled.** The integration lab (netns, single host, userspace generators over a veth) is a **correctness/integration** lab: it validates *behavior* (does a mechanism engage correctly), not *throughput ceilings*. It cannot produce realistic DDoS scale (tens of thousands of conns/sec, real resource exhaustion, throughput/latency-at-scale). A realistic stress/benchmark capability needs a different substrate: - **Kernel-bypass traffic generation** — DPDK or AF_XDP — to drive line-rate floods a userspace/veth generator can't (this is why WARP17 is DPDK-based and doesn't work in netns). - Likely **dedicated hardware / dedicated NICs** (or at least SR-IOV / a multi-host testbed), and measurement of throughput, latency-under-load, and resource exhaustion at scale. This is coupled to the deferred DDoS-lab **Layer II** (XDP/eBPF data-plane testing) and to **sub-project B** (the XDP fast path) — both need the eBPF/XDP toolchain. Realistic stress testing is the natural companion to building the XDP mitigation. Until then, deception/mitigation "under load" gates in the lab are explicitly **resilience/correctness** gates (e.g. drop-at-cap enforced, legit survives, no crash), not stress benchmarks. Context: see the `blackwall-trafficgen` foundation (DDoS lab M1a, #61) and the `ddos-lab-xdp-testing-research` design notes. WARP17 reference: https://github.com/Juniper/warp17