Linux BPFDoor iptables NAT Redirect
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a legitimate service port to a high ephemeral shell port (42391-43390) without disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
CQL
