DDoS Protection with Count-Min Sketch Rate Limiting

import { sketchRateLimit } from "throttlekit";

const limiter = sketchRateLimit({
  limit: 100,
  windowMs: 60_000,
  // epsilon/delta trade accuracy for memory (defaults shown):
  epsilon: 0.01,   // at most epsilon*N overcount with probability >= 1-delta
  delta: 0.001,
});

console.log("fixed capacity:", limiter.capacity, "counters"); // never grows

const d = limiter.checkSync("192.0.2.1");

interface SketchRateLimiter {
  checkSync(key: string, cost?: number): Decision;
  check(key: string, cost?: number): Promise<Decision>;
  reset(): void;
  readonly capacity: number; // counter count (depth × width); fixed for the limiter's life
}

import { ManualClock, sketchRateLimit } from "throttlekit";

// ── 1. Fixed memory regardless of key count ──────────────────────────────────
function exactWithinBudget(): void {
  const clock = new ManualClock(0);
  const limiter = sketchRateLimit({ limit: 5, windowMs: 1_000, clock });

  console.log(`capacity: ${limiter.capacity} counters (~7.4 KiB), fixed for life`);

  // 1,000 distinct IPs, each making one request, are all admitted.
  // Memory has not grown.
  let admitted = 0;
  for (let i = 0; i < 1_000; i++) {
    if (limiter.checkSync(`198.51.100.${i}`).allowed) admitted++;
  }
  console.log(`1,000 distinct IPs → ${admitted} admitted; capacity still ${limiter.capacity}`);
}

// ── 2. Volumetric flood sheds safely ────────────────────────────────────────
function floodShedsSafely(): void {
  const clock = new ManualClock(0);
  const limiter = sketchRateLimit({ limit: 5, windowMs: 1_000, clock });

  // 1,000,000 distinct keys. A per-key limiter would allocate ~1M records.
  // The sketch holds fixed memory and sheds aggressively — always in the safe direction.
  let admitted = 0;
  for (let i = 0; i < 1_000_000; i++) {
    if (limiter.checkSync(`flood-${i}`).allowed) admitted++;
  }
  console.log(`1,000,000 keys → ${admitted} admitted; capacity still ${limiter.capacity}`);
}

// ── 3. Never over-admits a hot key ──────────────────────────────────────────
function neverOverAdmits(): void {
  const clock = new ManualClock(0);
  const limiter = sketchRateLimit({ limit: 5, windowMs: 1_000, clock });

  let allowed = 0;
  for (let i = 0; i < 20; i++) {
    if (limiter.checkSync("attacker").allowed) allowed++;
  }
  console.log(`hot key: ${allowed} allowed out of 20 (limit 5) — never over-admits:`, allowed <= 5);

  // Window roll resets the budget
  clock.advance(1_000);
  console.log("after window roll, allowed again:", limiter.checkSync("attacker").allowed);
}

exactWithinBudget();
floodShedsSafely();
neverOverAdmits();

import { mergeableSketch, sketchSnapshotFromBytes } from "throttlekit";

// Each node maintains its own sketch
const local = mergeableSketch({
  epsilon: 0.01,
  delta: 0.001,
  // All nodes in the cluster MUST use the same seed for merges to be meaningful
  seed: 0x9e3779b1, // the default fixed seed — peers merge out of the box
});

// Track local traffic
local.add("192.0.2.1");
local.add("192.0.2.1");
local.add("203.0.113.5");

// Ship to a coordinator (any transport you own: gossip, HTTP, gRPC)
const bytes = local.toBytes();
// ...on the coordinator:
const snap  = sketchSnapshotFromBytes(bytes);
coordinator.merge(snap);

// Query the global estimate
console.log("global count for 192.0.2.1:", coordinator.estimate("192.0.2.1"));