Products / Network Protection / In-House Filtering

An In-House Datapath

Q: What is XDP and why does it matter for DDoS mitigation?

XDP (eXpress Data Path) runs filtering code at the earliest possible point in the Linux network stack, inside the NIC driver, before the kernel allocates sockets or connection state. That is what makes line-rate drops possible: malicious packets are discarded before they can consume any origin resources.

Q: Does Gateway Sentry resell another provider’s scrubbing?

No. The eBPF/XDP filter programs are written and operated in-house and run on hardware Gateway Sentry operates. When attack patterns evolve, the datapath is updated directly, without waiting on an upstream vendor.

Q: Does driver-level filtering add latency for clean traffic?

Clean packets pass through the same driver-level path with per-packet work measured in microseconds. There is no scrubbing-center detour: filtering happens on the same edge that forwards your traffic.

Every packet that arrives at a Gateway Sentry site is checked on the spot, and anything malicious is thrown away before it ever reaches your server. The filtering is our own code running on our own hardware, so when an attack changes, we change with it.

XDP driver-level filtering<1 s to mitigateline rate by default

Get Protected Network Protection overview

What Runs Where

The pipeline is real: five stages between the wire and your origin

Ingress

Anycast lands each packet at the nearest PoP, splitting attack load across sites before filtering even begins. An attacker has to beat the whole network at once; your users just reach the closest edge.

XDP Parse

Driver-level parse and sanity checks run before the kernel allocates a socket or any per-connection state. Malformed and impossible packets never cost more than the nanoseconds it takes to read them.

Protocol Programs

Dedicated TCP and UDP programs apply rate limits, SYN validation, fingerprint checks, and per-flow state. Each protocol is judged by rules written for how that protocol actually behaves.

Verdict

Malicious packets drop at line rate. High-volume banlists are pushed down into NIC flow tables on supported hardware, freeing CPUs for traffic that deserves inspection.

Delivery

Clean traffic forwards to your origin, or stays on-net when the workload runs on Sentry Compute. Either way, what reaches the application is traffic worth serving.

Written Here, Run Here

The filter programs are written, compiled, and deployed by the same team that operates the network. When a new attack pattern appears, the datapath changes; there is no vendor ticket in the loop.

What an Attacker Sees

Nothing. Floods terminate at the driver with no backpressure and no error responses. The service behind the edge simply stays up.

Keep Exploring

Anycast Delivery

How protected traffic reaches the datapath: anycast and unicast addressing, forwarding, and on-net origins.

Attack Analytics

What the datapath records: every detection, exact totals, clean versus dropped.

Trusted Networks

Teach the datapath which networks are yours, so your own traffic never trips a defense.

Our Network

The PoPs this pipeline runs in, verifiable through public looking glasses.

Frequently Asked Questions

What is XDP and why does it matter for DDoS mitigation?

XDP (eXpress Data Path) runs filtering code at the earliest possible point in the Linux network stack, inside the NIC driver, before the kernel allocates sockets or connection state. That is what makes line-rate drops possible: malicious packets are discarded before they can consume any origin resources.

Does Gateway Sentry resell another provider’s scrubbing?

No. The eBPF/XDP filter programs are written and operated in-house and run on hardware Gateway Sentry operates. When attack patterns evolve, the datapath is updated directly, without waiting on an upstream vendor.

Does driver-level filtering add latency for clean traffic?

Clean packets pass through the same driver-level path with per-packet work measured in microseconds. There is no scrubbing-center detour: filtering happens on the same edge that forwards your traffic.

Get Protected in Minutes

Provision from the dashboard; usage-based billing from the first packet

Get Protected