WIRE-SPEED PACKET FILTERING & ENTERPRISE NETWORKING

Pornphawit Samerkit
eBPF / XDP & Anti-DDoS Architect

Architecting multi-10Gbps line-rate Linux kernel bypass defenses, 802.3ad bonded routing, Anycast BGP meshes, and high-concurrency low-level network infrastructures with zero packet drop tolerance.

xdp_hook@kernel:~$ core_competency:

Communication: 🇹🇭 ภาษาไทย (Native) 🇨🇳 中文 / 普通话 (流利·工作交流) 🇬🇧 English (Professional)

Launch XDP Simulator

100Gbps+

Scrubbing Line-Rate

0-Copy

AF_XDP Kernel Bypass

25G LACP

Mellanox CX-4 Trunk

antiddos_xdp_core.c

Kernel eBPF

#include <linux/bpf.h>

#include <bpf/bpf_helpers.h>

// Line-rate driver XDP hook before SKB allocation

SEC("xdp")

int xdp_antiddos_filter(struct xdp_md *ctx) {

void *data = (void *)(long)ctx->data;

void *data_end = (void *)(long)ctx->data_end;

// Inspect IP & L4 headers at wire speed

struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_DROP;

// Check eBPF LRU Blacklist & SYN Flood cookie

__u32 src_ip = parse_ipv4(data, data_end); if (bpf_map_lookup_elem(&blocked_ips, &src_ip)) {

return XDP_DROP; // 0 cpu softirq overhead

}

// Normal traffic handed directly to Linux stack

return XDP_PASS;

}

// Target: ConnectX-4 25G / Intel E810 Driver Hook

Verifier Verified (4096 instructions passed) Clang 18 / LLVM eBPF

Live Kernel Engine Simulator

Interactive XDP Line-Rate Traffic Scrubber

Simulate multi-million packets-per-second volumetric attacks. Toggle kernel bypass eBPF XDP hook to observe real-time packet dropping with zero kernel stack overhead.

Attack Vector:

XDP Kernel Bypass

Ingress Rate

125,000 PPS

Packet arrival velocity

Bandwidth Volume

1.2 Gbps

L2 Ingress Payload

XDP Action: DROP

0 Pkt

Kernel bypass sanitized

XDP Action: PASS

125,000 Pkt

Forwarded to Linux IP Stack

Packet Flow Visualizer: NIC Ring Buffer → XDP Driver Hook → Linux Kernel Netfilter STATUS: CLEAN TRAFFIC

Pornphawit Samerkit

Senior Network & Systems Engineer

Bangkok, Thailand (Global Remote Ready)

Specialized in the intersection of Linux kernel networking, high-speed switching architectures, and high-concurrency software services. Dedicated to eliminating bottleneck overhead through hardware-aware software design.

Languages & Communication

🇹🇭 ภาษาไทย (Thai) Native / แม่ภาษา

🇨🇳 中文 / 普通话 (Chinese) 流利 / Fluent (Professional)

🇬🇧 English Professional Working

Direct Contact: [email protected]

Specialty: XDP / eBPF • 802.3ad Bonding • BGP

System Architecture Philosophy

Stop attacks before the Linux network stack even allocates an sk_buff.

Conventional firewalls collapse under massive volumetric assaults due to socket buffer allocations and context switches. By leveraging eBPF and XDP directly at the network card's ring buffer layer, I build defensive infrastructure capable of discarding tens of millions of attack packets per second without exhausting CPU softirqs.

eBPF/XDP Anti-DDoS

SYN Flood, UDP Reflection/Amp, DNS flood scrubbing, zero-copy socket steering with eBPF maps and AF_XDP.

High-Speed LACP & BGP

Dual 25GbE/10GbE ConnectX-4 link aggregation, Policy-Based Routing (PBR), Netplan, and Anycast routing.

Low-Level Systems & Go

High-throughput reverse proxies, real-time HLS/DASH media redirectors, epoll I/O multiplexing, C & Go.

Virtualization & Mesh VPN

Proxmox VE enterprise clusters, MikroTik RouterOS/CHR, Zero-Trust Tailscale, WireGuard, Xray/VLESS.

Technical Competencies

Network Engineering & Anti-DDoS Stack

Deep, production-hardened expertise spanning network protocols, kernel internals, and high-concurrency systems.

XDP

eXpress Data Path

Kernel Bypass, XDP_DROP

eBPF

Extended BPF

Maps, Tail Calls, CO-RE

L3/L4 Volumetric Defense

SYN Cookies, UDP Amp

AF_XDP Sockets

UMEM, Zero-Copy Ring

802.3ad LACP Bonding

ConnectX-4, 25GbE/10GbE

BGP Routing & Anycast

BIRD, FRR, Multi-homing

Policy-Based Routing

IP Rule, Table Separation

MikroTik RouterOS / CHR

VLANs, Queues, FastPath

Golang Systems

High Concurrency, Netpoll

C / Linux Socket API

epoll, Raw Sockets, I/O

Rust (Network Core)

Tokio, Aya eBPF crate

Streaming & Edge Proxies

HLS/DASH, Custom Dispatch

Proxmox VE & KVM

PCIe Passthrough, OVS

Tailscale & WireGuard

Zero-Trust Mesh, DERP relay

Docker & Containers

Macvlan, Host-Net, Rootless

Xray / VLESS & Overlay

TLS Camouflage, Fallbacks

Production Systems

Featured Engineering Projects

Real-world low-latency architectures, line-rate scrubbers, and multi-gigabit bonded router setups.

eBPF Kernel Bypass

// XDP Driver Hook Metrics

Scrub: 32.4M PPS Overhead: ~0% CPU

IronShield Wire-Speed XDP Scrubber

Line-rate packet filter dropping SYN floods, UDP amplification, and malformed fragments directly inside the network driver before OS packet scheduling.

C eBPF XDP_DROP ConnectX-4

v3.2.0

Network Routing

// Trunk: 802.3ad Link Aggregation

Bond: 2x 25GbE (50G) PBR: Active

Nexus25G Dual LACP Carrier Core

Carrier-grade edge routing system utilizing Mellanox ConnectX-4 dual-port SFP28 interfaces, Policy-Based Routing, and Netplan for deterministic failovers.

802.3ad LACP PBR BGP FRR Netplan

Dual SFP28

High-Concurrency Go

// Concurrent Stream Redirector

Sessions: 85,000 req/s epoll I/O

Vortex High-Concurrency Stream Engine

Ultra-fast HLS/DASH dynamic media proxy and tokenized redirector built in Go, designed to dispatch millions of video chunk requests with sub-millisecond latencies.

Go 1.23 HLS / DASH FastHTTP Redis Ring

Production

Kernel Debug Console

Interactive Engineer Shell

Explore profile metadata. Try help, skills --network, xdp --status, or languages.

root@samerkit-edge-node:~#

Pornphawit Samerkit OS Console (Kernel 6.8.0-net-xdp)

Type 'help' to view available network & profile commands.

samerkit@ebpf:~#

Let's Collaborate

Need Wire-Speed Defense or High-Throughput Routing?

I'm available for senior network engineering consultations, eBPF/XDP anti-DDoS architecture deployments, and mission-critical low-latency systems development.

Primary Email

[email protected]

Multilingual Working Proficiency

Thai (Native) • 中文 (流利) • English (Fluent)

100% Ready

Network Operations

BGP / Anycast • Anti-DDoS Scrubbing

24/7 Resilient

Send an Architectural Inquiry

Reach out directly regarding anti-DDoS scrubbing, LACP bonding, or system design.

Pornphawit Samerkit eBPF / XDP & Anti-DDoS Architect