DEV Community

weilong
weilong

Posted on

I built an eBPF-powered "Judge" that executes packets based on Shannon Entropy. Break my Realm.

The Core Philosophy: Beyond Signatures
​Most firewalls are librarians; they check books against a list of banned titles. I wanted a Judge. I built Realm 2.5, an active defense engine that runs in the kernel and judges the "chaos" of incoming payloads.
​The Tech Stack
​L3 Execution via XDP: By leveraging eBPF (XDP), Realm processes and drops malicious packets at the network driver level. It doesn't wait for the Linux stack to wake up; it acts on arrival.
​The Entropy Sentencing: I use Shannon Entropy to analyze the randomness of every payload. If the entropy H exceeds 4.2, the payload is deemed "maliciously obfuscated," and the source IP is instantly beheaded (banned) in the eBPF maps.
​Honeypot Labyrinths: I've left active baits on ports 2375 (Docker), 2222 (SSH), and 6379 (Redis). One touch, and you're out.
​The Cyberpunk Dashboard
​The backend isn't just a log; it's an archive of failed attempts. You can see the live "executions" on my dashboard, designed with a heavy cyberpunk aesthetic to remind attackers of the digital wall they just hit.
​The Challenge
​I am a student of the kernel, and I know that no wall is infinite. I've deployed this on a GCP instance. I invite you—the wizards and the curious—to test its limits. Can you bypass the entropy filter?
​🌐 Live Target: http://35.212.157.202/
​🛠️ Source Code: xingkong0508/realm
​A Final Word
​I am fully prepared for the moment this fortress is breached. In the world of security, perfection is an illusion. But until that moment of total compromise arrives, I remain fearless. If you break it, I will learn, I will adapt, and I will be back with something stronger. Do your worst.

Top comments (0)