git404hub

what is packetyeeter fr?

awlx/packetyeeter — explained in plain English

Analysis updated 2026-05-18

13GoAudience · ops devopsComplexity · 5/5Setup · hard

tl;dr

A Go tool that protects Linux servers from DDoS floods by inspecting and dropping malicious traffic inside the kernel using eBPF.

vibe map

mindmap
  root((PacketYeeter))
    What it does
      Blocks DDoS traffic
      Works inside kernel
      Uses eBPF XDP and TC
    Detections
      SYN flood detection
      Bad TCP flags
      ICMP and UDP rate limits
    Tech stack
      Go
      eBPF
      Linux XDP TC
    Use cases
      Server flood protection
      Traffic reputation scoring
      HAProxy integration
    Audience
      Server operators
      Network security teams

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Protect an internet-facing Linux server from SYN flood and ping flood attacks.

VIBE 2

Automatically block IP addresses whose behavior looks like a scan or an attack.

VIBE 3

Track which countries or providers are sending abusive traffic.

VIBE 4

Share IP block lists between PacketYeeter and an existing HAProxy setup.

what's the stack?

GoeBPFLinux XDPLinux TCgRPCPrometheusHAProxyGeoIP

how it stacks up fr

awlx/packetyeeterhuey1in/kiroclaimkleimer/vpn_over_ssh
Stars131313
LanguageGoGoGo
Setup difficultyhardmoderatehard
Complexity5/53/54/5
Audienceops devopsops devopsops devops

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · hard time til it works · 1h+

Requires Linux with eBPF/XDP support and kernel-level setup, not a simple install.

The README does not state a license.

in plain english

PacketYeeter is a tool that protects Linux servers from being overwhelmed by malicious network traffic, the kind of flood often called a DDoS attack. It is written in Go and plugs directly into the Linux kernel using a technology called eBPF, which lets it inspect and block bad traffic very quickly, before it can slow down or crash the server. The tool watches for several kinds of attacks. It can spot SYN flood attacks, where an attacker starts many connection requests but never finishes them, tying up server resources. It also checks for TCP packets with invalid or suspicious flag combinations, a common sign of a network scan. Operators can set an allowlist of trusted IP addresses or ranges that will never be blocked, and can write custom rules for whole blocks of addresses, choosing to block or just monitor them. Every time PacketYeeter drops a packet, it records what happened and why, so operators keep a clear trail of what was blocked and when. It also limits the rate of ICMP and UDP traffic from any single source, which helps stop ping floods and amplification attacks. A notable part of the system is a reputation engine. Every IP address, and even fingerprints taken from network connections, gets a score based on how suspicious its behavior looks. Scores rise when bad behavior is detected and slowly fade over time if the behavior stops, so temporary issues are not punished forever. If a score gets too high, PacketYeeter treats that source as a bad actor and blocks it, or just logs it if running in a test mode. The tool can also enrich its data using GeoIP databases, tagging traffic with the country or internet provider it came from, making it easier to see where attacks originate. PacketYeeter can also connect to HAProxy, a popular web traffic manager, so the two systems can share block decisions. This project is aimed at people who run and secure Linux servers exposed to the internet, particularly those wanting protection against network flooding attacks without adding much delay to normal traffic.

prompts (copy fr)

prompt 1
Explain how PacketYeeter uses eBPF to drop malicious packets before they reach the Linux network stack.
prompt 2
Walk me through setting up an IP allowlist in PacketYeeter so trusted addresses are never blocked.
prompt 3
Show me how PacketYeeter's reputation scoring decides when to treat an IP as a bad actor.
prompt 4
Help me connect PacketYeeter to HAProxy using the Peer Protocol for shared IP blocking.

Frequently asked questions

what is packetyeeter fr?

A Go tool that protects Linux servers from DDoS floods by inspecting and dropping malicious traffic inside the kernel using eBPF.

What language is packetyeeter written in?

Mainly Go. The stack also includes Go, eBPF, Linux XDP.

What license does packetyeeter use?

The README does not state a license.

How hard is packetyeeter to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is packetyeeter for?

Mainly ops devops.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.