XDP Packet Processing Verdicts

XDP Packet Processing Verdicts An architecture diagram generated by Archify. NIC · incoming packets · Architecture component NIC incoming packets XDP programs · driver-level hook · Architecture component XDP programs driver-level hook XDP_DROP · Drop packet · Architecture component XDP_DROP Drop packet XDP_PASS · Pass to kernel stack · Architecture component XDP_PASS Pass to kernel stack XDP_TX · Bounce out same NIC · Architecture component XDP_TX Bounce out same NIC XDP_REDIRECT · Forward to another interface · Architecture component XDP_REDIRECT Forward to another interface XDP_ABORTED · Error handling · Architecture component XDP_ABORTED Error handling packet arrives Legend Backend Security External

Before the kernel stack

  • • Decides before packets reach the kernel network stack
  • • Ideal spot for DDoS defense and load balancing

Five verdicts

  • • DROP discards before any sk_buff allocation
  • • REDIRECT hands off to another NIC, CPU, or AF_XDP socket