The overview
What it does.
Kernel-level DDoS protection for services that cannot afford downtime. Aegis Guard filters traffic with eBPF/XDP at the network driver, validates connections before they ever reach the application, and pairs that data plane with a live operations dashboard. Attacks are dropped at the earliest possible point while legitimate users stay connected.
Under the hood
The details matter.
- 01
A multi-stage rule pipeline in XDP applies IP, GeoIP, and ASN policies and discards unwanted traffic before the kernel network stack ever processes it.
- 02
Connection validation makes clients prove they are genuine before the protected service hears about them, so spoofed connection floods are stopped before they reach the server.
- 03
Layered rate limiting at per-IP, subnet, and global scope absorbs volumetric and connection floods while legitimate users keep their connections.
- 04
Behavioral analysis identifies clients that do not behave like legitimate users, so enforcement is not limited to raw traffic volume.
- 05
A Go agent owns the kernel program and firewall integration end to end and cleans up its own resources on shutdown.
- 06
Real-time metrics stream to the dashboard over WebSocket and land in TimescaleDB, so operators can watch an attack as it happens and study its pattern afterwards.
Next project / 06
Aegis VPN