Possibility to attach without any config

[dolgovas]

Hello! I tried to find this in docs, but didn't..
Does it have possibility to attach to interface without any modification and after on some trigger load synproxy program?

why?
because when you attach xdp on-air to interface (i have ixgbe driver) link is going down and up after few ms....
It's not really comfortable in production.

I tried to run xdpcookie all-time, but it uses more cpu, than without when we drop many traffic on nftable with hook = ingress

[kucejan]

Hi!

At the moment the program is designed to be loaded and always‑on.
There is no built‑in mechanism to attach XDP without any functional change and later enable SYN cookie logic based on an external trigger.

Regarding the link flap: the project was primarily developed and tested on Mellanox NICs (mlx5_core). Intel drivers -- especially ixgbe --- were not part of the testing, so the behavior you’re seeing may be specific to that driver.

About the higher CPU usage: the SYN cookie reply requires computing a hash and performing extra checksum validation/recalculation. This can increase CPU load compared to nftables ingress filtering.
Are you using a configuration where these operations can be offloaded to the NIC? On Mellanox cards this makes a noticeable difference.

If you need runtime control, it should be straightforward to add a small condition at the beginning of the XDP program:
read a value from a BPF array map, and based on that value either execute the SYN cookie logic or bypass it.
You can update that map from userspace using tools like bpftool, which gives you a simple on/off switch without detaching the program.

[dolgovas]

Got it. Thank you. I hope we will migrate to another NICs. After I'll check it one more time. If you want - you can close this issue