perf(deception): sample per-packet reply-send drop log (log-flood hygiene) #260

Merged

vxfemboy merged 1 commit from fix/deception-drop-log-throttle into main

2026-08-03 22:54:39 +00:00

vxfemboy commented

2026-08-03 21:48:37 +00:00

Owner

Problem

drop_and_log did an unconditional eprintln! per dropped reply. Under a
spoofed-source SYN/UDP flood every syn-cookie reply to an unroutable source
fails identically (ENETUNREACH), so the flood produces one log line per
packet: a 10-second lab flood emitted 133,121 lines. In a real deployment
under a real flood that is a log-flood DoS - millions of identical lines/sec
drowning the journal and burning I/O on the box that is already under attack.

Change

Sample the log: print the first failure and every 1024th thereafter, carrying
the running total so a burst stays visible. ~133k lines -> ~130. Same
Verdict::Drop behaviour; only log volume changes. should_sample_drop_log
extracted as a pure, unit-tested helper.

Not a fix for the syncookie lab flake

An earlier revision of this PR claimed it addressed the deception-syncookie
throughput flake. A lab run disproved that: with the log throttled to ~130
lines the generator still only reached 36344 pps (vs 30-35k unthrottled) -
within noise, still below the 50%-of-77k fidelity floor. That flake is host
CPU contention (the victim NFQUEUE engine competing with the co-located
generator on a shared runner) and is tracked separately. This PR is log
hygiene only.

Verification

clippy/fmt/unit tests green for blackwall-deception. The lab job is red
on the unrelated deception-syncookie throughput gate, not on this change.

## Problem `drop_and_log` did an unconditional `eprintln!` per dropped reply. Under a spoofed-source SYN/UDP flood every syn-cookie reply to an unroutable source fails identically (`ENETUNREACH`), so the flood produces one log line per packet: a 10-second lab flood emitted **133,121 lines**. In a real deployment under a real flood that is a log-flood DoS - millions of identical lines/sec drowning the journal and burning I/O on the box that is already under attack. ## Change Sample the log: print the first failure and every 1024th thereafter, carrying the running total so a burst stays visible. ~133k lines -> ~130. Same `Verdict::Drop` behaviour; only log volume changes. `should_sample_drop_log` extracted as a pure, unit-tested helper. ## Not a fix for the syncookie lab flake An earlier revision of this PR claimed it addressed the `deception-syncookie` throughput flake. A lab run disproved that: with the log throttled to ~130 lines the generator still only reached 36344 pps (vs 30-35k unthrottled) - within noise, still below the 50%-of-77k fidelity floor. That flake is host CPU contention (the victim NFQUEUE engine competing with the co-located generator on a shared runner) and is tracked separately. This PR is log hygiene only. ## Verification `clippy`/`fmt`/unit tests green for `blackwall-deception`. The lab job is red on the unrelated `deception-syncookie` throughput gate, not on this change.

vxfemboy added 1 commit

2026-08-03 21:48:37 +00:00

perf(deception): sample the per-packet reply-send drop log

CI / check (pull_request) Successful in 11m36s

Details

CI / lab (pull_request) Failing after 7m53s

Details

485c8c0ab5

Under a spoofed-source SYN/UDP flood every syn-cookie reply to an
unroutable source fails identically (ENETUNREACH), and the nfqueue
transport logged one eprintln! line per dropped packet. Each call takes
the stderr lock and issues a write syscall, so the deception-syncookie
lab gate emitted a ~64k-line flood on the victim node. That stderr
contention burns CPU on the box shared with the trafficgen generator and
is a plausible cause of the gate's intermittent sub-50%-of-target pps
fidelity flake (a lab run confirms). It would also drown a real
deployment's logs during an actual spoofed flood.

Sample the log instead: print the first failure and every 1024th
thereafter, carrying the running total so a burst stays visible. Same
Verdict::Drop behaviour; only log volume changes. Extracted
should_sample_drop_log(seen) as a pure, tested helper.

vxfemboy changed title from ~~perf(deception): sample per-packet reply-send drop log (syncookie throughput flake)~~ to perf(deception): sample per-packet reply-send drop log (log-flood hygiene)

2026-08-03 22:25:09 +00:00

vxfemboy referenced this pull request

2026-08-03 22:36:43 +00:00

fix(lab): flood deception-syncookie with reduced-set spec (fix throughput flake) #262

vxfemboy merged commit 9dda1100d3 into main

2026-08-03 22:54:39 +00:00

vxfemboy deleted branch fix/deception-drop-log-throttle

2026-08-03 22:54:39 +00:00

vxfemboy referenced this pull request from a commit

2026-08-03 22:54:40 +00:00

perf(deception): sample per-packet reply-send drop log (log-flood hygiene) (#260)

vxfemboy referenced this pull request