An eBPF Loophole: Using XDP for Egress Traffic

They say "By the time a packet reaches the TC hook, the kernel has already processed it through various subsystems for routing, firewalling, and even connection tracking." but surely this is also true before it reaches the VETH?

I understand they are attached to the phrase "loophole" but it feels fairly like they are using it as designed to me?

From 2022: https://www.samd.is/2022/06/13/egress-XDP.html

You can also use XDP for outgoing packets for tap interfaces.

Also wondering, why not just use DPDK?

Great post.

In some scenarios veth is being replaced with netkit for a similar reason. Does this impact how you're going to manage this?

XDP (eXpress Data Path) is the fastest packet processing framework in linux - but it only works for incoming (ingress) traffic. We discovered how to use it for outgoing (egress) traffic by exploiting a loophole in how the linux kernel determines packet direction. Our technique delivers 10x better performance than current solutions, works with existing Docker/Kubernetes containers, and requires zero kernel modifications.

This post not only expands on the overall implementation but also outlines how existing container and VM workloads can immediately take advantage with minimal effort and zero infrastructure changes.

Hi HN, Shivansh (founder) here, happy to answer any questions folks might have about the implementation and the benchmarks!

Hey I can’t browse the link crashes on ios