awlx/packetyeeter

PacketYeeter is a tool that protects Linux servers from being overwhelmed by malicious network traffic, the kind of flood often called a DDoS attack. It is written in Go and plugs directly into the Linux kernel using a technology called eBPF, which lets it inspect and block bad traffic very quickly, before it can slow down or crash the server. The tool watches for several kinds of attacks. It can spot SYN flood attacks, where an attacker starts many connection requests but never finishes them, tying up server resources. It also checks for TCP packets with invalid or suspicious flag combinations, a common sign of a network scan. Operators can set an allowlist of trusted IP addresses or ranges that will never be blocked, and can write custom rules for whole blocks of addresses, choosing to block or just monitor them. Every time PacketYeeter drops a packet, it records what happened and why, so operators keep a clear trail of what was blocked and when. It also limits the rate of ICMP and UDP traffic from any single source, which helps stop ping floods and amplification attacks. A notable part of the system is a reputation engine. Every IP address, and even fingerprints taken from network connections, gets a score based on how suspicious its behavior looks. Scores rise when bad behavior is detected and slowly fade over time if the behavior stops, so temporary issues are not punished forever. If a score gets too high, PacketYeeter treats that source as a bad actor and blocks it, or just logs it if running in a test mode. The tool can also enrich its data using GeoIP databases, tagging traffic with the country or internet provider it came from, making it easier to see where attacks originate. PacketYeeter can also connect to HAProxy, a popular web traffic manager, so the two systems can share block decisions. This project is aimed at people who run and secure Linux servers exposed to the internet, particularly those wanting protection against network flooding attacks without adding much delay to normal traffic.