Developer Builds Single-Process C WAF That Bans IPs in 26ms Using Linux Kernel Tools

A developer has released Linux Log Guardian, an open-source, MIT-licensed web application firewall written in C that consolidates log parsing, threat scoring, and IP banning into a single binary process. The tool tails Nginx access logs using zero-copy parsing and io_uring I/O, then scores requests against 121 OWASP Core Rule Set patterns compiled with PCRE2 JIT, achieving a reported throughput of 114,003 events per second. When a ban threshold is triggered, the pipeline enforces blocks at the network interface level via XDP eBPF maps, bypassing the Linux network stack entirely, with an automatic fallback to ipset if XDP is unavailable. The system achieves a median ban latency of approximately 26 milliseconds, compared to the fragmented multi-daemon architectures it aims to replace. It also introduces granular policy controls such as Named Skips and Purpose Binding to reduce false positives and prevent threat intelligence feeds from directly writing kernel ban rules without explicit authorization.