On some NICs (e.g. Netronome), the eBPF code gets compiled to the native code of a core on the NIC and runs there before the kernel even sees the packet. How cool is that?
Wondering whether some Mellanox NICs also have xdp offload... At 2x100Gbps I'd at least like make it help reorder, coalesce packets with application-protocol knowledge.
Anyone seen XDP use cases other than DDOS protection and firewall-like stuff?
I have been thinking about it for kernel-bypass CPU-bypass packet capture: DMA them directly to a big-ass hugepages-mapped ring buffer, where unprivileged user processes can then pick off interesting ones.
I use onload now, from an isolated core, but freeing up that core would be better.
Mmmh. I've been looking at the 'affordable' big-memory (4-6TB) HPE confs for just this kind of 'snapshot to disk every bit from all 10GbE NICs for the previous 10 minutes' feature.