Stop DDoS floods in seconds — with one binary.
Kapkan reads the traffic stats your routers already export (NetFlow, IPFIX, sFlow), spots a flood against the IPs you protect within seconds, and stops it — by telling your router to drop the attack, or by dropping it itself in the Linux kernel. Free, open source, and in safe watch-only mode until you say otherwise.
How it works, in four steps.
One binary, nothing else to run — no extra services, no message queue, no database. Point your routers at it and go.
Point your routers at Kapkan. They already send a summary of every traffic flow — NetFlow, IPFIX or sFlow — so just aim it at Kapkan's port. One process reads it all; there's nothing else to install.
Kapkan counts packets, bits and connections per second for each IP you protect. Cross a limit you set — or one it learned from that host's normal traffic — and that's an attack, flagged within seconds.
Kapkan tells your router to drop the attack over BGP. It can null-route the whole target IP (RTBH), or drop only the attack traffic and keep the rest flowing (FlowSpec). Once the flood stops, it removes the rule itself.
Or skip the router: if the traffic crosses the machine Kapkan runs on, it can drop the attack itself inside the Linux kernel (XDP), the moment packets arrive. Every rule has an expiry the kernel enforces, so a crashed Kapkan can't keep dropping your traffic.
The features others charge for — free.
What commercial flow-DDoS products bundle and charge thousands for, in one Apache 2.0 binary: detection, mitigation, an operator console, and the safety rails to run it in production.
Reads the flows you already export
sFlow v5, NetFlow v5/v9 and IPFIX over UDP, read by Kapkan itself — no extra service to run.
Spots floods in under a second
Packet, bit and flow-per-second limits over a sliding window, corrected for sampling — ≥20M flows/sec per core.
Blackhole, or drop just the attack
Null-route the whole target IP (RTBH), or drop only the attack traffic and keep the rest (FlowSpec). Full IPv6 support, on par with IPv4.
Tells you what kind of attack
Amplification (NTP/DNS/memcached), SYN/UDP/ICMP floods — each with a plain 'why this fired' breakdown.
Learns each host's normal
Kapkan learns what normal traffic looks like for every host and tightens the limits on its own. No hand-tuning.
Hard to misfire
Starts in watch-only mode. Every block has an expiry and lifts itself, a cap limits how many hosts can be blocked at once, and your protected list is never blocked — not by Kapkan, not by you.
Catches carpet-bombing
Spots low-and-slow floods spread across a whole IP range that stay under any single host's limit.
Watch it from anywhere
REST API, Prometheus /metrics, and alerts over Telegram, Slack, email, webhook or a script you run.
Multi-tenant & audited
Scope access per tenant, hand out viewer/operator API tokens, and get an audit log that names who did what.
In-kernel mitigation with XDP
Instead of asking a router to drop the attack, Kapkan can do it itself. The same rules it would announce as FlowSpec load straight into the Linux kernel and run there (XDP) — including a separate rate limit for each attacking source, which BGP FlowSpec can't do. Needs Linux 5.15+, compiles nothing on the box, and every rule expires inside the kernel, so a crashed Kapkan can't leave your traffic dropped. Still watch-only by default.
See how in-kernel drop worksA real operator console, included — free.
No digging through raw logs. Kapkan ships with a live web console for your on-call — attacks, hosts and blocks in one place.
How we compare.
A modern, single-binary replacement for pricey legacy flow analyzers.
| Feature | Kapkan | Commercial tools |
|---|---|---|
| License | Free & open source (Apache 2.0) | Paid license / volume-based |
| Operator console | Included free | Paid add-on |
| IPv6 support | Full, same as IPv4 | Missing or planned |
| Threshold tuning | Learns automatically | Offline calculator, copy-paste |
| Automation | Escalation rules in config | Custom bash scripts |
| Architecture | One static binary, no extras | Several daemons to run |
| In-kernel drop | Built in — drops in Linux itself (XDP) | Separate scrubbing appliance |
Running in minutes — watch-only first.
Kapkan is safe to run out of the box. It logs every block it would make and shows it in the API and console, but never announces anything to your routers until you explicitly set dry_run: false.
$ make build
$ ./kapkan -config config.yaml
---
dry_run: true
networks: ["203.0.113.0/24"]
thresholds: { pps: 80000, mbps: 1000 }
bgp: { local_asn: 65010, community: "65010:666" }Set the trap. Protect your network.
Free forever. Apache 2.0. Up and running in an afternoon.