Protect your servers with kernel-level precision.

XDP (eXpress Data Path) is a Linux kernel hook that runs eBPF programs on packets the moment they reach the network driver — before the kernel allocates any memory for them or runs its full network stack. That's why XDP can drop up to 10 million packets per second per CPU core with sub-millisecond latency, while iptables and nftables inspect packets further down the stack and are typically 50× to 100× slower on DDoS-grade traffic. PAKKT runs XDP as a first stateless layer (volumetric drop) and nftables as a second stateful layer (conntrack, TCP flags, NAT).

No. The agent installs with a single curl command, loads the XDP program into the running kernel via eBPF, and inserts nftables rules into an isolated "inet pakkt" table. There is no restart, no systemd reshuffle, and no interruption of existing services. The same applies to uninstalling — the agent detaches the XDP program and flushes its nftables table cleanly.

No. XDP runs before iptables/nftables in the kernel data path, so it doesn't touch your existing rules. PAKKT's nftables rules live in a separate "inet pakkt" table, which means Docker's iptables chains, fail2ban jails and your own nftables rules are untouched. The install script scans for conflicts (iptables, nftables, UFW, firewalld, CSF, fail2ban, CrowdSec, Shorewall, ipset, ip6tables) and offers to disable only managers that would break XDP — Docker rules are explicitly never modified.

PAKKT supports Debian 11+, Ubuntu 22.04+ and most recent Linux distributions on kernel 5.9 or later. The XDP engine uses eBPF features that have been stable since kernel 5.9 (2020). The installer auto-detects your OS and kernel version and refuses to install if XDP support is missing, so you never end up in a broken state.

PAKKT costs 3 € per server per month, billed via Stripe. There are no tiers, no bandwidth limits and no hidden fees — one agent protects one VPS or dedicated server, whatever its size. A 7-day free trial is included with no credit card required: you can install, deploy rules and watch real traffic before any payment method is requested.

No. The agent only sends aggregated counters (packets passed, packets dropped, per-port totals, top source IPs by volume) to the PAKKT backend over mTLS every 30 seconds — never full payloads, never packet captures. Source IPs are stored in a short-retention hypertable (90 days) to power the dashboard and are never shared with third parties.

Less than 1 millisecond per packet on a modern CPU. XDP runs before the network stack, so legitimate packets pass through the engine's allow list in a handful of CPU cycles — measurable only under microbenchmark. The nftables layer adds a few microseconds per connection state lookup. In practice, users don't see any difference versus a server without PAKKT.

Yes. Running the uninstall command detaches the XDP program from every interface, flushes the "inet pakkt" nftables table, removes the agent binary and its systemd unit, and leaves your system in its original state. No residual rules, no kernel lingering, no orphan config files.