We start building our own inline filtering system, on top of XDP and eBPF.
Filtering at the XDP hook means a packet is inspected and dropped inside the network driver, before the kernel allocates a socket buffer for it. That is the cheapest possible place to say no, and it is what makes line-rate mitigation on commodity servers realistic rather than theoretical.
Buying an appliance would have been faster. Writing it ourselves means the mitigation follows our network, our PoPs and our customers' traffic patterns — and that we can ship a new rule the day an attack changes shape, instead of filing a feature request with a vendor.
Where it ended up: