The Paradigm Shift in High-Speed Networking
The industry has moved decisively toward XDP/eBPF for high-speed packet processing. Understanding why requires comparing the two approaches across the dimensions that matter in production:
| Dimension | DPDK | XDP/eBPF |
|---|---|---|
| Speed | Extremely fast (100 Mpps+) | Near-DPDK fast (50–100 Mpps+) |
| Safety | None — kernel panic possible | eBPF verifier guarantees safety |
| Coexistence | Exclusive NIC ownership | Shares NIC with kernel stack |
| Tooling | tcpdump/iptables broken | All standard tools work |
| Container support | Complex, requires workarounds | Native (Cilium, Katran) |
| Hardware requirements | Often NIC-specific PMDs | Any driver with XDP hook |
| Protocol stack | Must reimplement everything | Reuse kernel's TCP/IP |
| Deployment complexity | Very high | Moderate |
| Observability | Custom only | Full Linux observability |
Real-world adoption:
- Cloudflare uses XDP for DDoS mitigation, dropping attack traffic at the driver level before it consumes any meaningful CPU. Their
xdp-filterdrops packets at rates exceeding 20 million per second per CPU core. - Facebook/Meta built Katran, an open-source L4 load balancer using XDP, replacing hardware load balancers across their infrastructure.
- Cilium is a Kubernetes CNI plugin built entirely on eBPF. It replaces kube-proxy (which uses iptables) with eBPF programs that handle service load balancing, network policy enforcement, and observability — all at XDP/TC hook speed.
- Suricata (IDS/IPS) uses AF_XDP sockets to receive packets from XDP programs at zero-copy speeds for deep packet inspection.
When DPDK is still the right choice:
DPDK remains appropriate for dedicated, single-purpose appliances where:
- 100% of the CPU is allocated to packet processing (no other workloads).
- You need absolute maximum throughput (e.g., carrier-grade NAT processing terabits of traffic).
- You have hardware engineering resources to maintain custom PMDs.
- The operational isolation is acceptable because the box does exactly one thing.
For anything running in a general-purpose Linux environment — cloud instances, Kubernetes nodes, application servers with a firewall — XDP/eBPF is the correct choice.
A common senior-level interview question: "Cilium claims to replace iptables with eBPF. Why is eBPF faster than iptables for Kubernetes service routing?" The answer has two parts. First, iptables rules are evaluated linearly — with 10,000 services, every packet traverses up to 10,000 rules. eBPF uses hash map lookups, which are O(1) regardless of the number of services. Second, iptables hooks fire deep in the kernel stack (after sk_buff allocation), while eBPF TC hooks fire earlier. The combination of O(1) lookups and earlier hook placement gives Cilium dramatically better latency and throughput at scale.