10Gb NIC performance + UDP Flood

[save99]

Hello!

Some of our clients are often receiving DNS reflection attack/general UDP flood @~3Gbit/400Kpps. At the moment our core router is connected to our switch directly at 10Gbit. We had the idea to put a pfSense server between router and switch to filter traffic, but we have some question:

• Will pfSense able to filter DNS reflection attack and, in general, UDP flood attacks?
• We are going to put a dual port Chelsio 10Gbit NIC with the fastest dual core CPU/RAM we will find on the pfSense server, but how much pps will it handle? Did someone have any experience with those NICs?

Thank you!