CLI Reference

CLI Reference

axdp is the installed administration entry point. With no subcommand it runs axdp stats. Read-only commands may work for users with the required map/socket permissions; configuration, BPF, service, and firewall changes require root.

Status and monitoring

Command	Purpose
axdp / axdp stats	Show backend, interface, packet counters, and byte counters.
axdp stats --watch	Continuously print snapshots.
axdp stats --rates --interval 2	Show packet/bit rate deltas.
axdp watch	Shorthand for stats --watch.
axdp tui	Open the curses-based interactive dashboard.
axdp ports	List active TCP, UDP, and SCTP admission ports.
axdp ports --watch --interval 2	Watch listener/policy changes.
`axdp conntrack [tcp	udp
axdp backend	Show the actual backend, XDP mode, attachments, and health.
axdp status	Show service status followed by protection health.

Useful overrides:

sudo axdp stats --interface eth0
sudo axdp tui --interface eth0 --interval 1
sudo axdp tui --socket /var/run/auto_xdp/pkt_events.sock

Service control and synchronization

sudo axdp start
sudo axdp stop
sudo axdp restart
sudo axdp sync

Service actions manage both xdp-port-sync and the installed auto-xdp-relay. sync runs one reconciliation pass; the daemon normally handles this automatically.

General configuration

sudo axdp config show
sudo axdp config init
sudo axdp log-level
sudo axdp log-level debug
sudo axdp under-attack
sudo axdp under-attack on
sudo axdp under-attack off

config init only creates a missing file. Log levels are debug, info, warning, and error. Under-attack mode disables XDP drop-event ring-buffer writes while leaving filtering and counters active.

Trusted CIDRs

sudo axdp trust list
sudo axdp trust add 203.0.113.5/32 monitoring
sudo axdp trust add 2001:db8:1234::/48 office-v6
sudo axdp trust del 203.0.113.5/32

The default label is manual. CIDRs are normalized to their network address.

Trusted TCP sources may send a pure SYN to a port that was not discovered and bypass SYN limits. Trusted UDP sources do not open closed ports; they bypass UDP limits and port handlers only after the destination port is admitted.

Per-CIDR port ACLs

sudo axdp acl list
sudo axdp acl add tcp 198.51.100.0/24 5432 6379
sudo axdp acl add udp 198.51.100.10/32 53
sudo axdp acl del tcp 198.51.100.0/24

A rule is identified by protocol and CIDR and can contain up to 64 ports. A TCP ACL can admit listed ports even when they were not discovered. A UDP ACL still requires the destination UDP port to be admitted.

Permanent ports

sudo axdp permanent list
sudo axdp permanent add tcp 2222 alt-ssh
sudo axdp permanent add udp 51820 wireguard
sudo axdp permanent add sctp 5060 signaling
sudo axdp permanent del tcp 2222

Permanent ports do not depend on a listener process. SCTP is not socket-discovered and must be managed here.

Discovery exclusions

sudo axdp exclude list
sudo axdp exclude port add 3306 6379
sudo axdp exclude port del 3306
sudo axdp exclude src add 10.0.0.0/8 192.168.0.0/16
sudo axdp exclude src del 10.0.0.0/8

Port exclusions block automatic discovery but do not override a permanent port. Source exclusions refer to local listener bind addresses, not remote client addresses.

Protocol slot handlers

sudo axdp slot list
sudo axdp slot load gre
sudo axdp slot load esp
sudo axdp slot load sctp
sudo axdp slot load 47 /path/to/custom_gre.o
sudo axdp slot load 47 /path/to/custom_gre.c
sudo axdp slot unload 47
sudo axdp slot unload gre

Built-in names map to GRE 47, ESP 50, and SCTP 132. A .c input is compiled with clang; an .o is loaded directly. Successful operations persist the handler configuration.

TCP/UDP port handlers

sudo axdp port-handler list
sudo axdp port-handler load tcp 25565 /path/to/minecraft_handler.o
sudo axdp port-handler load udp 53 /path/to/dns_validate.c
sudo axdp port-handler unload tcp 25565

Add --no-config-update for an intentionally temporary runtime-only change. It will not survive service restart.

Updates and uninstall

sudo axdp check-update
sudo axdp check-update --force
sudo axdp uninstall
sudo axdp uninstall eth0 eth1

See Uninstall and Recovery before removing a remote host firewall.