eBPF Networking & XDP

eBPF program types, XDP packet processing pipeline, Cilium eBPF dataplane, BPF maps, and bpftrace for network debugging.

Overview

Overview eBPF (extended Berkeley Packet Filter) allows safely running sandboxed programs in the Linux kernel without modifying kernel source code. Originally designed for packet filtering (classic BPF in tcpdump), eBPF now powers networking, observability, and security in production at scale.

eBPF program types for networking: - XDP (eXpress Data Path): attaches at the lowest point in the network driver, before the kernel networking stack allocates an sk_buff. Three modes: DRV (driver-native, fastest), SKB (generic, slower), HW (offloaded to NIC). Actions: XDP_DROP, XDP_PASS, XDP_TX (hairpin), XDP_REDIRECT. - TC (Traffic Control): attaches at the tc ingress/egress hook. Has access to sk_buff metadata. Used for NAT, packet mangling, and policy after sk_buff allocation. - Socket programs: sk_filter for per-socket packet filtering, sockops for TCP socket option manipulation, sk_msg for redirecting between sockets.

BPF maps: kernel data structures shared between eBPF programs and user space. Types: hash, array, LRU hash, per-CPU variants, ring buffer. Used for connection tracking, rate limit counters, policy rules, and observability data export.

Cilium: Kubernetes CNI that uses eBPF to replace kube-proxy (iptables) entirely. Policy enforcement, load balancing, encryption (WireGuard/IPSec), and observability (Hubble) are all implemented as eBPF programs. At 1M iptables rules, iptables lookups are O(n); eBPF hash maps are O(1).

bpftrace: high-level tracing language for writing eBPF probes. Single-line network debugging: bpftrace -e 'tracepoint:net:net_dev_queue { @[args->name] = count(); }' — counts packets per interface in real time.

Key concepts

XDP (eXpress Data Path)
eBPF hook at the NIC driver level, before sk_buff allocation. Fastest possible packet processing — can drop/redirect millions of packets per second per core. Used for DDoS mitigation and load balancing.
BPF map
Kernel data structure (hash, array, ring buffer, etc.) shared between eBPF programs and user space via file descriptors. Persists across program invocations — used for connection state, counters, and policy tables.
Cilium
Kubernetes CNI using eBPF for all networking: pod-to-pod routing, L3/L4/L7 NetworkPolicy, kube-proxy replacement (eBPF load balancing), encryption, and Hubble flow observability.
Hubble
Cilium observability layer built on eBPF. Provides per-flow L3/L4/L7 visibility without sidecar proxies — DNS queries, HTTP requests, TCP connections, drop reasons — all exported as structured flow records.
bpftrace
High-level language for writing eBPF tracing probes. Supports tracepoints, kprobes, uprobes, and USDT. Enables one-liner kernel debugging without C programming or kernel recompilation.

When to use it

  • Explaining why Cilium outperforms iptables-based kube-proxy at scale
  • Debugging network performance with bpftrace one-liners
  • Designing DDoS mitigation at the XDP layer (drop before kernel stack)
  • Understanding how Kubernetes network policy is enforced at the eBPF level

Interview questions

  • How does Cilium eBPF replace iptables for Kubernetes networking, and why is it better at scale?
  • What is XDP and how is it used for DDoS mitigation?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio