(Chống Lũ means anti-flooding in Vietnamese)
Chống Lũ listens and parses incoming packets on NIC, an IP will get blocked (via ipset) if it made too many SYN requests per second without ACK.
We use PF_RING for capturing packets, and libipset for blocking zoombies.