================================================================================ ARGUS ENGINE BY PROMETHEUS DYNAMICS — BENCHMARK & MITIGATION EVIDENCE LOG URL: https://prometheusdynamics.ca/argus Document ID: PD-ARGUS-EVIDENCE-2026-10 Sanitization Note: Client/host IP addresses are replaced with RFC 5737 documentation addresses (203.0.113.88 / ops@edge-node-01). Proprietary Argus kernel calibration values and internal daemon paths are omitted. ================================================================================ 1. TEST ENVIRONMENT & HARDWARE SPECIFICATION -------------------------------------------------------------------------------- Instance Size : 1 vCPU / 512 MB RAM / 10 GB SSD (Cloud Virtual Machine) Operating System : Ubuntu 24.04.1 LTS (Linux 6.8.0-106-generic x86_64) Web Stack : NGINX 1.24.0 (Ubuntu) with TLSv1.3 / OpenSSL 3.0.13 Management Ports : OpenSSH Server active on Port 22 (standard) & Port 2222 (custom) Load Generator : wrk 4.2.0 (4 threads, 1,000 concurrent HTTPS connections) 2. PART 1 — REPEATED PERFORMANCE: THREE CONSECUTIVE 30-SECOND RUNS (90 SECONDS CUMULATIVE PER PROFILE @ 1,000 CONCURRENT HTTPS CONNECTIONS) -------------------------------------------------------------------------------- Command executed for each 30-second run: $ wrk -t4 -c1000 -d30s -H "Host: prometheusdynamics.ca" https://127.0.0.1/ Note: Runs #1, #2, and #3 were executed as three consecutive 30-second tests (90 seconds cumulative per profile) on the same server. --- [A] STOCK BASELINE PROFILE (Ubuntu 24.04 / NGINX Factory Defaults) --- [Stock Baseline — Run #1 (30s)] Running 30s test @ https://127.0.0.1/ 4 threads and 1000 connections Thread Stats Avg Stdev Max +/- Stdev Latency 311.42ms 142.18ms 1.79s 78.14% Req/Sec 462.15 184.92 1.12k 69.40% 34429 requests in 30.10s, 3.00GB read Socket errors: connect 3392, read 288, write 0, timeout 310 Non-2xx or 3xx responses: 340 Requests/sec: 1143.82 Transfer/sec: 102.06MB [Stock Baseline — Run #2 (30s)] Running 30s test @ https://127.0.0.1/ 4 threads and 1000 connections Thread Stats Avg Stdev Max +/- Stdev Latency 338.65ms 136.40ms 1.64s 81.12% Req/Sec 431.08 176.55 0.98k 71.25% 31898 requests in 30.08s, 2.78GB read Socket errors: connect 2126, read 14, write 0, timeout 228 Non-2xx or 3xx responses: 154 Requests/sec: 1060.35 Transfer/sec: 94.63MB [Stock Baseline — Run #3 (30s)] Running 30s test @ https://127.0.0.1/ 4 threads and 1000 connections Thread Stats Avg Stdev Max +/- Stdev Latency 364.10ms 129.85ms 1.58s 83.40% Req/Sec 398.44 168.10 0.91k 73.18% 28418 requests in 30.11s, 2.47GB read Socket errors: connect 2315, read 0, write 0, timeout 223 Non-2xx or 3xx responses: 137 Requests/sec: 943.89 Transfer/sec: 84.01MB Stock Baseline 3x30s Cumulative Summary (90s cumulative): - Total Requests Completed : 94,745 requests (8.25 GB read) - Run-to-Run RPS Trend : 1,143.82 -> 1,060.35 -> 943.89 RPS (-17.5% decay) - Socket Connect Errors : 7,833 total (3,392 + 2,126 + 2,315) - Socket Read Resets : 302 total (288 + 14 + 0) - Socket Timeouts : 761 total (310 + 228 + 223) - Non-2xx/3xx (HTTP 5xx) : 631 total (340 + 154 + 137) --- [B] ARGUS ENGINE ENABLED PROFILE (Same 1 vCPU / 512 MB Server) --- [Argus Engine — Run #1 (30s)] Running 30s test @ https://127.0.0.1/ 4 threads and 1000 connections Thread Stats Avg Stdev Max +/- Stdev Latency 468.12ms 118.45ms 1.42s 74.10% Req/Sec 524.80 241.12 1.34k 68.20% 38677 requests in 30.08s, 3.38GB read Socket errors: connect 0, read 0, write 0, timeout 212 Non-2xx or 3xx responses: 0 Requests/sec: 1285.61 Transfer/sec: 114.95MB [Argus Engine — Run #2 (30s)] Running 30s test @ https://127.0.0.1/ 4 threads and 1000 connections Thread Stats Avg Stdev Max +/- Stdev Latency 461.85ms 115.90ms 1.39s 74.85% Req/Sec 531.40 248.60 1.38k 68.95% 39215 requests in 30.09s, 3.42GB read Socket errors: connect 0, read 0, write 0, timeout 198 Non-2xx or 3xx responses: 0 Requests/sec: 1303.19 Transfer/sec: 116.52MB [Argus Engine — Run #3 (30s)] Running 30s test @ https://127.0.0.1/ 4 threads and 1000 connections Thread Stats Avg Stdev Max +/- Stdev Latency 512.30ms 124.10ms 1.51s 71.60% Req/Sec 468.90 229.40 1.21k 66.80% 32944 requests in 30.06s, 2.88GB read Socket errors: connect 0, read 0, write 0, timeout 224 Non-2xx or 3xx responses: 0 Requests/sec: 1096.02 Transfer/sec: 98.00MB Argus Engine 3x30s Cumulative Summary (90s cumulative): - Total Requests Completed : 110,836 requests (9.68 GB read, +16,091 reqs / +17.0%) - Peak 30s Run Throughput : 1,303.19 RPS (116.52 MB/s transfer) - Socket Connect Errors : 0 total (0 / 0 / 0 across all 3 runs) - Socket Read Resets : 0 total (0 / 0 / 0 across all 3 runs) - Socket Timeouts : 634 total (212 + 198 + 224) - Non-2xx/3xx (HTTP 5xx) : 0 total (0 / 0 / 0 across all 3 runs) 3. PART 2 — 4-WAY FLOOD TEST CONFIGURATION & CROWDSEC SPECIFICATION -------------------------------------------------------------------------------- Flood Workload Relationship (1,500 Attempted vs. 430 Observed Connections): - Attempted Concurrency : An external multi-threaded flood generator attempted to establish 1,500 concurrent keep-alive TLS connections (300 worker threads x 5 sockets per thread) against Port 443 over a 20-second window. - Behavior Without Cut-Off (Stock / Tuned-Only / CrowdSec Log Mode): Because no automated transport block was triggered during the 20s window, the generator continued opening sockets toward the 1,500 target—overflowing Stock queues or saturating user-space NGINX worker CPU under Tuned-Only. - Observed Concurrency at Argus Cut-Off (430 Connections): Argus's in-memory telemetry loop polls the kernel TCP socket table every 1.0 second (configured threshold: >50 concurrent connections per IP). On the first poll during flood ramp-up, 430 established connections were observed from 203.0.113.88. Argus immediately injected the NIC driver and routing block (<1.0s), cutting off the remaining attempted handshakes and dropping 5,223 subsequent attack packets. Tested CrowdSec Configuration (Profile #3): - Package & Version : crowdsec v1.4.6 (1.4.6+ds1-2ubuntu0.2, Ubuntu 24.04) - Remediation Component : crowdsec-firewall-bouncer-iptables (netfilter/iptables) - Installed Collections : crowdsecurity/linux, crowdsecurity/nginx - Active Scenarios : crowdsecurity/nginx-req-limit-exceeded, crowdsecurity/http-crawl-non_statics, crowdsecurity/http-probing, crowdsecurity/http-bad-user-agent, crowdsecurity/ssh-bf - Monitored Log Sources : /var/log/nginx/access.log, /var/log/nginx/error.log, /var/log/auth.log - Scope Note : CrowdSec separates detection from remediation and also offers optional in-line AppSec/Lua web-server integrations for HTTP request inspection. In the tested default file-tailing configuration above, NGINX writes access.log entries only after an HTTP request completes or closes. Because the tested flood held idle keep-alive TLS sockets open without completing HTTP requests, zero access.log lines were emitted during the 20s flood, resulting in 0 active decisions (`No active decisions`). Daemon Resource Footprint Measurements (Recorded on 1 vCPU / 512 MB RAM Server): $ ps -C crowdsec,crowdsec-firewall-bouncer -o pid,comm,rss,vsz,%cpu,%mem PID COMMAND RSS VSZ %CPU %MEM 18412 crowdsec 51420 1184920 26.4 10.9 18489 crowdsec-firewa 12380 692140 4.8 2.3 -> CrowdSec Combined: 62.3 MB Physical RAM (13.2% of 512MB), 1.79 GB Virt, 31.2% CPU $ ps -o pid,comm,rss,vsz,%cpu,%mem (Argus In-Memory Telemetry + eBPF Loader) PID COMMAND RSS VSZ %CPU %MEM 19204 argus-daemon 15052 23348 5.8 3.1 -> Argus Combined : 14.7 MB Physical RAM (3.1% of 512MB), 22.8 MB Virt, 5.8% CPU (4.2x lower physical RAM, 78x lower virtual memory, 5.4x lower CPU overhead) 4. PART 3 — EXTERNAL LEGITIMATE VISITOR PROBE TIMING RECORDS (10 REQUESTS/PROFILE) -------------------------------------------------------------------------------- External WAN probe requesting uncached HTTPS pages (`https://prometheusdynamics.ca/?nocache=`) with a 2.5s–3.7s client timeout threshold during the active flood: [Profile 1: Stock Baseline Under Flood — 6/10 Succeeded (4 Timed Out)] Req #01: HTTP 200 | 412.4 ms Req #02: HTTP 200 | 589.1 ms Req #03: TIMEOUT | >2512.9 ms (Connection timed out) Req #04: HTTP 200 | 744.8 ms Req #05: TIMEOUT | >2508.4 ms (Connection timed out) Req #06: HTTP 200 | 692.0 ms Req #07: TIMEOUT | >2511.2 ms (Connection timed out) Req #08: HTTP 200 | 648.3 ms Req #09: TIMEOUT | >2509.7 ms (Connection timed out) Req #10: HTTP 200 | 618.4 ms -> Summary: 6/10 probe requests succeeded (60.0%) | Avg (completed): 617.5 ms | Peak: >2,512.9 ms [Profile 2: "Tuned-Only" (Increased OS/NGINX Limits, No Argus) — 10/10 Succeeded, Severe CPU Lag] Req #01: HTTP 200 | 842.1 ms Req #02: HTTP 200 | 1194.6 ms Req #03: HTTP 200 | 1640.2 ms Req #04: HTTP 200 | 3478.5 ms (Severe user-space CPU starvation) Req #05: HTTP 200 | 1812.0 ms Req #06: HTTP 200 | 1120.4 ms Req #07: HTTP 200 | 915.8 ms Req #08: HTTP 200 | 690.3 ms Req #09: HTTP 200 | 612.7 ms Req #10: HTTP 200 | 556.4 ms -> Summary: 10/10 probe requests succeeded (100.0%) | Avg: 1,286.3 ms (+364% vs Argus) | Peak: 3,478.5 ms [Profile 3: Free CrowdSec v1.4.6 (Default Log Mode + iptables Bouncer) — 6/10 Succeeded] Req #01: HTTP 200 | 398.5 ms Req #02: TIMEOUT | >2516.8 ms (Connection timed out) Req #03: HTTP 200 | 512.0 ms Req #04: TIMEOUT | >3703.2 ms (Connection timed out) Req #05: HTTP 200 | 494.6 ms Req #06: HTTP 200 | 538.1 ms Req #07: TIMEOUT | >2519.4 ms (Connection timed out) Req #08: HTTP 200 | 462.9 ms Req #09: TIMEOUT | >2524.1 ms (Connection timed out) Req #10: HTTP 200 | 481.1 ms $ cscli decisions list No active decisions -> Summary: 6/10 probe requests succeeded (60.0%) | 0 active decisions in 20s | Peak: >3,703.2 ms [Profile 4: Full Argus Engine Enabled — 10/10 Legitimate Probe Requests Succeeded] Req #01: HTTP 200 | 391.0 ms | NORMAL (<500ms) Req #02: HTTP 200 | 349.2 ms | NORMAL (<500ms) Req #03: HTTP 200 | 285.1 ms | NORMAL (<500ms) Req #04: HTTP 200 | 238.7 ms | FAST (Snappy Response) Req #05: HTTP 200 | 260.9 ms | NORMAL (<500ms) Req #06: HTTP 200 | 273.0 ms | NORMAL (<500ms) Req #07: HTTP 200 | 258.7 ms | NORMAL (<500ms) Req #08: HTTP 200 | 222.3 ms | FAST (Snappy Response) Req #09: HTTP 200 | 233.6 ms | FAST (Snappy Response) Req #10: HTTP 200 | 260.4 ms | NORMAL (<500ms) -> Summary: 10/10 legitimate probe requests succeeded (HTTP 200 OK) | Avg: 277.3 ms | Min: 222.3 ms | Max: 391.0 ms 5. PART 4 — NIC DRIVER PACKET-DROP COUNTER & CUSTOM SSH (PORTS 22 & 2222) RECORD -------------------------------------------------------------------------------- [NIC Driver Drop Counter Verification During Flood] Offending Source IP : 203.0.113.88 (Observed at 430 concurrent connections > 50 limit) Mitigation Layer 1 : eBPF/XDP Native Driver Map on eth0 -> 5,223 packets dropped at NIC driver Mitigation Layer 2 : Kernel FIB Blackhole Route -> `blackhole 203.0.113.88` installed [Administrative SSH Preservation Test on Ports 22 and 2222] Configuration Tested: OpenSSH daemon listening on Port 22 and non-standard Port 2222; protected_ports map populated at Argus startup with [22, 2222] + policy routing exemption. Test executed from the actively blocked host (203.0.113.88) while Port 443 was blocked: 1) HTTPS Request to Port 443 from 203.0.113.88: $ curl -I --connect-timeout 3 https://prometheusdynamics.ca/ curl: (28) Connection timed out after 3015 milliseconds (Dropped at NIC driver) 2) Custom SSH Request to Port 2222 from the same blocked IP (203.0.113.88): $ ssh -p 2222 ops@edge-node-01 "echo SSH_PORT_2222_OK && uptime" SSH_PORT_2222_OK Handshake & command completion time: 44.8 ms (<50 ms, administrative access preserved) ================================================================================