Alexander Krizhanovsky – Practical Volumetric DDoS Mitigation with Linux and Open Source
Alexander Krizhanovsky is CEO of Tempesta Technologies and the architect of Tempesta’s open-source, full-stack DDoS protection and bot management platform. That includes Tempesta xFW for high-performance L3/L4 DDoS mitigation, Tempesta FW for L7 DDoS protection and web security, and WebShield for advanced bot management.
He has designed and led development on high-performance network traffic processing systems, including a Web Application Firewall recognized in the Gartner Magic Quadrant, along with highly scalable S3 and NFS servers built around network I/O, multicore scalability, and efficient data processing. Alexander has spoken at CppCon, Netdev, SCALE, Linux Conf Australia, All Things Open, FOSDEM, SeaGL, Percona Live, IBM CASCON, and other conferences, and authored a high-performance lock-free MPMC ring buffer queue published by Linux Journal.
At BalticNOG 2026, Alexander will bring this work to the stage with his talk, “Practical Volumetric DDoS Mitigation with Linux and Open Source.”
Where These Filters Actually Run
Volumetric DDoS protection can sit in a few different places: on a host that terminates TCP connections, on a router protecting downstream networks, or on a scrubbing node handling redirected traffic. Each position gives the filter a different view of the traffic, a router-based filter might see mostly attack traffic, or only client-to-server flows, depending on where it sits.
Alexander will cover the always-on, on-demand, and hybrid deployment models built around these positions, and why modern hit-and-run attacks, often lasting well under a minute, put real pressure on all three approaches.
Why eBPF Fits This Problem
Despite their differences, these filtering approaches share a lot of underlying functionality, and Alexander will show how that functionality maps onto Linux eBPF. eBPF programs run on commodity Linux systems with standard network adapters, operating close to the driver itself, which lets them process traffic at 100+ Gbps without specialized hardware.
What the Talk Covers
Alexander will walk through open-source eBPF implementations of filters for TCP SYN, ACK, and RST floods, DNS reflection, random UDP floods, and ICMP floods. He’ll discuss how to handle attacks that use spoofed source addresses, a problem that undercuts a lot of standard filtering logic, and cover deployment safety and monitoring for running these filters in production.
He’ll close with performance numbers from real testing on an x86-64 server with a 200 Gbps NIC, giving a concrete sense of what these open-source tools can actually handle.
Why You Shouldn’t Miss This Talk
If you’re responsible for keeping a network up during a volumetric attack, this talk gives you working, open-source approaches you can actually deploy, not just theory. Alexander brings both the architecture and the benchmark numbers to back it up.
Whether you operate a host, a router, or a scrubbing node, this talk gives you a clear look at what Linux and eBPF can do for DDoS mitigation today.
đź“… When: 23-24 September 2026
đź“Ť Where: BalticNOG 2026, Riga, Latvia
đź”— Don’t miss BalticNOG! Register today: https://balticnog.org/tickets/
