Comment by tptacek

14 hours ago

Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).

3 comments

tptacek

Reply

Aachen 9 hours ago

https://en.wikipedia.org/wiki/Express_Data_Path for anyone else wondering what that is

tptacek 9 hours ago
tl;dr: eBPF programs that run hot off the DMA buffers, before skbufs are created, that can XDP_DROP packets.
- dilyevsky 6 hours ago
  
  In some cases on the NIC itself! (i'm sure you know this)