BGPulse

DDoS detection, mitigation and RTBH platform for service providers.

ALPHA Infrastructure & Ops · 7 features · Go · PHP / CI4 · BGP · VPP

overview

BGPulse is a single-tenant DDoS platform: traffic feeds flow into a Go daemon that detects attacks, runs them through a finite-state machine, and executes mitigations — BGP /32 and /128 blackholes, FlowSpec, scripts, nftables or webhooks.

Panel and daemon are separate: the CI4 panel holds the spec, attacks, metrics and releases; enrolled nodes report in. One-command Debian install starts everything in safe shadow mode.

features

  • ▸Embedded BGP speaker + multi-source feeds — sFlow, IPFIX, NetFlow, port-mirror, SNMP
  • ▸Detect → FSM → executors — BGP blackhole, FlowSpec, script, nft, webhook
  • ▸Shadow mode — detect and report without touching the network until you promote
  • ▸Panel + daemon architecture — enrolled nodes, groups, whitelists, BGP peers, releases
  • ▸VPP dataplane bridge for kernel-blackhole routehooks
  • ▸Billing webhooks — WHMCS, Blesta, XodoPanel integrations
  • ▸CLI ops — bgpulse status|traffic|doctor|attacks|ban|whitelist

stack

Go PHP / CI4 BGP VPP nftables InfluxDB/Telegraf

get started

quickstart
$ sudo deploy/install-debian.sh --quickstart
$ bgpulse doctor && bgpulse status
▊