Installation

Installation

TFPS runs on Linux kernel 5.15 or newer with BTF enabled. Capture uses AF_PACKET and enforcement uses XDP. It does not bind a SIP port, so it can run beside a PBX, proxy, or SBC.

Prerequisites

• Rust with the x86_64-unknown-linux-musl target;
• a musl-capable C compiler (musl-tools or Zig);
• clang and bpftool on the target host; and
• root, or equivalent CAP_NET_RAW, CAP_BPF, and CAP_NET_ADMIN capabilities. Some kernels also require CAP_SYS_ADMIN.

On Debian or Ubuntu, install the target-side XDP tools with:

sudo apt install clang linux-tools-common

Build

git clone https://github.com/sippulse/tfps.git
cd tfps
cargo test
cargo build --release --target x86_64-unknown-linux-musl

If musl cannot compile the bundled SQLite dependency, Zig can provide the compiler:

export CC_x86_64_unknown_linux_musl="zig cc -target x86_64-linux-musl"
export AR_x86_64_unknown_linux_musl="zig ar"
cargo build --release --target x86_64-unknown-linux-musl

Install

Run the installer as root from the checkout containing the built binaries:

sudo ./packaging/install.sh

The installer compiles the XDP program against the running kernel, installs tfps and tfps_ctl, installs and starts the systemd unit, and creates a starter configuration only when /etc/tfps/config.json does not exist. It is safe to run again for an upgrade and does not overwrite the configuration.

Safe first run

Add trusted carriers, gateways, and management networks to ignoreip, then observe without enforcement first:

sudo tfps --no-enforce -v

Confirm that TFPS sees the intended interface and SIP port and review its classifications. Then remove --no-enforce to enable XDP. Keep behavioural detection off initially; it is not needed for perimeter prevention.

journalctl -u tfps -f
sudo tfps_ctl status
sudo tfps_ctl stats