Defending Against L7 DDoS and Web Bots with Tempesta FW
1 December 2025
Tempesta FW 0.8 introduces a zero-copy per-CPU access logs streaming to a ClickHouse database. This article discusses how to analyse that data for L7 DDoS mitigation and bot management. Finally, we introduce our new open-source project, WebShield, which automatically detects and blocks bad bots.
The ‘Made You Reset’ HTTP/2 DDoS Attack: Analysis and Mitigation
13 August 2025
The new HTTP/2 attack 'Made You Reset' CVE-2025-8671 affects many HTTP servers. In this post we deeply analyze the attack, how does it relate to previous HTTP/2 attacks and how to properly protect against the attack.
Memory safety and network security
22 January 2025
The US government recently issued several documents advocating a transition from C, C++, and Assembly to memory-safe languages like Rust, particularly for software with high-security requirements. In this article, we explore the current state of safety in modern C and C++, leveraging modern compilers, and discuss why not everything can be rewritten in Rust.
Building your own WordPress staging with Tempesta FW
9 April 2024
There are many articles on the Internet about website staging, what it is and why do you need one. In this article we describe how to build your own staging and a couple of gotchas you might face on this way.
Tempesta FW 0.7: WordPress, HTTP/2 and the fastest TLS
1 October 2023
You probably noticed that the website looks different. It not only looks different, but the whole machinery is different. We...
Understanding Nginx tail latencies
23 February 2022
We traced Nginx running on a 80 CPU server as a CDN node in one of the world largest Internet exchange points. We revealed that a lightweight monitoring process may cause severe latencies due to the Linux CPU scheduler. During the investigations, we had a lot of fun with eBPF and perf.
Lean video conferencing billing – keep it simple, make it fast!
23 July 2021
Learn how to build a high-performance billing system for video conferencing services. This article studies the case of a lean startup who we helped build the system. We focus not only on the system performance, but also how to make it with as low budget as possible.
Performance of ORDER BY over text columns in MariaDB and MySQL
5 July 2021
It might sound strange, but database performance does depend on used encodings. In this post we explore why and compare performance on different encodings for MariaDB and MySQL.
Non-hierarchical caching for CDN
29 April 2021
The recent paper "The Storage Hierarchy is Not a Hierarchy: Optimizing Caching on Modern Storage Devices with Orthus" proposes interesting extensions for traditional caching. The approach might be beneficial in Video on demand (VOD) content delivery networks (CDN) challenged by large amounts of stored data and high throughput requirements.
Fast programming languages: C, C++, Rust, and Assembly
28 October 2020
We explore several practical performance-critical tasks and how they can be solved in C, C++, Rust, and Assembly programming languages. We mostly focus on the speed, but also consider developer productivity and program safety. You might be surprised that solving some tasks in Assembly might be more productive than in C programming language!
User space TCP?
15 June 2020
Kernel bypass technologies like DPDK and Netmap are popular for the development of high-speed network applications. In this article we discuss user space TCP/IP stacks and their applicability for HTTPS servers.
Web application firewall acceleration
25 March 2020
From our experience in developing custom core logic of Web Application Firewalls (WAF), we learned several performance issues typical for most modern WAFs which may lead to high cost of ownership and/or denial of service. In this article, we introduce a WAF accelerator, which improves the performance of WAFs and protects them against DDoS attacks.
CPDoS: Cache Poisoned Denial of Service
12 December 2019
Being a lightweight web application firewall, Tempesta FW takes care of the prevention of well-known web cache deception and poisoning attacks. However, a new attack of the web cache poisoning class, Cache-Poisoned Denial-of-Service (CPDoS), has appeared and prompted us to extend our HTTP parser to prevent the attack.
Review of Google Snap paper
14 November 2019
Read our review of Google paper "Snap: a Microkernel Approach to Host Networking" presented at the ACM SIGOPS 27th Symposium on Operating Systems Principles (SOSP 2019). We compare the Snap approach with Tempesta FW synchronous sockets.
Recap NatSys Lab. blog
3 November 2019
We recap the most interesting posts since 2011 from our old NatSys Laboratory blog: the effect of the recent CPU vulnerabilities on Linux system calls performance, a deep dive into HTTP proxies functionality, performance comparison of Tempesta FW with Nginx and HAProxy, fast strings processing algorithms, lock-free data structures, and memory allocators. A lot of technical details!