eBPF maps are powerful enough to express any type of configuration and runtime information for packet processing engines. However, DDoS protection applications may step behind usual usecases, and corner cases of algorithms in the eBPF maps appear more often and strike harder.

Aggressive insertions into maps, exhaustion of preallocated space, and races - typical situations during an incoming DDoS attack. In this talk, we will cover additions that we had to make for the eBPF maps to make them more scalable under attacks and to drop malicious traffic more effectively, and additions that help us monitor situations better and avoid possible degradations.