PHREL Architectural Overview

PHREL v2.1.0 tracks incoming traffic on a per-host basis and enforces rate limits through a dedicated nftables table. The diagram below summarizes the major components.

                    Internet
                        |
                        v
              +---------------------+
              | Application Server  |
              | DNS, SMTP, HTTP,    |
              | SSH, etc.           |
              +---------------------+
                        |
                        v
              +---------------------+
              | NIC                 |
              +---------------------+
                        |
                        v
              +---------------------+
              | libpcap capture     |
              | (BPF filter)        |
              +---------------------+
                        |
                        v
              +---------------------+
              | Capture thread      |
              | - batch packet read |
              | - per-host counters |
              | - striped hash locks|
              +---------------------+
                        |
                        v
              +---------------------+
              | Datastore           |
              | (per-host samples)  |
              +---------------------+
                        |
                        v
              +---------------------+
              | Data thread         |
              | - threshold checks  |
              | - skip idle hosts   |
              | - rolling PPS sums  |
              +---------------------+
                 |            |
                 v            v
        +--------------+  +--------------+
        | nftables     |  | Redis (opt.) |
        | inet phreld  |  | peer sync    |
        +--------------+  +--------------+
                 |
                 v
            +---------+
            | Syslog  |
            +---------+

Capture Thread

The capture thread reads packets from the monitored interface using libpcap and a configurable BPF expression. In v2.1.0, packet reads are batched and the current second is cached in the capture loop. Per-host packet counts are stored in a hash table protected by 4096 striped locks, allowing concurrent capture and data-thread processing without a single global mutex.

Datastore

Each tracked host has a compact record with embedded sample arrays (one malloc per host). Include and exclude prefix ranges control which source addresses are tracked. The local server address is always excluded.

Data Thread

The data thread periodically evaluates per-host PPS against configured thresholds. It maintains an incremental rolling PPS sum at capture time and skips idle hash entries to reduce work. When a threshold is crossed, phreld inserts or updates rules in the dedicated inet phreld nftables table. Rules are removed automatically when traffic returns to normal.

Enforcement

PHREL requires nftables (the nf_tables kernel subsystem and libnftables). Rules are inserted into a flat per-host structure inside the inet phreld table. The action option selects drop, reject, or accept, and nft-priority controls hook evaluation order.

Redis Cross-Instance Sync

When Redis is configured, phreld writes local host statistics and reads peer statistics from other instances. This is useful for server farms behind load balancers where abusive traffic may be spread across multiple servers. Redis connection failure is non-fatal; phreld continues as a single-instance rate limiter.

Logging

Threshold crossings, rule insertions, and removals are logged to syslog.