Most people can't anycast, and even if they could I did not say that was even a mitigation strategy, you arguing a strawman. "firewall nodes at the edge which

Most people can't anycast, and even if they could I did not say that was even a mitigation strategy, you arguing a strawman. "firewall nodes at the edge which use ASIC/FPGA offload" and most people have that? I can't even think of companies that aren't FAANG or CDN providers that have anycastable ASIC enabled firewalls that can handle high pps/rps. > eBPF direct compilation to NPU instructions is already supported on Linux by some devices, which is one reason eBPF approaches have a lot of potential in this space. Ok, I think maybe we are talking about the same thing but what you call "firewalls" are in-house built DDoS scrubbers, which is not what I am talking about. There are also commercial DDoS scrubbers people can use, with or without anycasting. Back to the topic of this thread: firewalls, as in devices that inspect traffic using their CPU. PF based firewalls, sonicwall, fortigate, paloalto, sourcefire, those. You can build your own ddos scrubber compiling eBPF to NPUs and then afford those. Those are highly specialized purpose specific devices, they don't represent what people mean when they think of firewalls, as in ones you can buy or rent. It comes down to capacity, they typically can handle throughout just fine but high number of active sessions and very high pps is where most start choking.