XDP Packet Filtering

Phantom Grid utilizes eXpress Data Path (XDP) to filter packets at the lowest possible level in the Linux networking stack.

How it works

When a packet arrives at the Network Interface Card (NIC), the XDP program (phantom.c) intercepts it before the kernel allocates an sk_buff.

1. Protocol Parsing: The program parses Ethernet, IP, and TCP/UDP headers.
2. Port Matching: It checks if the destination port is in the hidden critical_ports map.
3. Action:
   • If hidden and not whitelisted: XDP_DROP (Packet vanishes).
   • If hidden and whitelisted: XDP_PASS (Packet goes to Application).
   • If Decoy Port: XDP_TX (Packet redirected to Honeypot).