<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing DDoS Mitigation — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-ddos-mitigation.

## Tools

### `nftables`

Linux packet filtering and rate limiting

**Usage:**
```bash
nft list ruleset
```

**Key Flags:**
  - `add rule: create filtering rule`
  - `add table: create table`
  - `list ruleset: show all rules`
  - `meter: per-source rate tracking`

---

### `sysctl`

Kernel parameter tuning

**Usage:**
```bash
sysctl -w net.ipv4.tcp_syncookies=1
```

**Key Flags:**
  - `-w: write parameter`
  - `-n: print value only`
  - `-a: show all parameters`

---

### `ss`

Socket statistics for connection monitoring

**Usage:**
```bash
ss -s
```

**Key Flags:**
  - `-s: summary statistics`
  - `-tan: TCP all numeric`
  - `state syn-recv: filter SYN_RECV`

---

### `nfdump`

NetFlow analysis for traffic profiling

**Usage:**
```bash
nfdump -r /var/cache/nfdump/current -s srcip -n 20
```

**Key Flags:**
  - `-r: read flow file`
  - `-s: stat field`
  - `-n: top N`
  - `-o extended: extended output`

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
