eBPF XDP: High-Performance Packet Filtering at the Driver Layer

Volumetric network attacks and high-speed port scans can easily overwhelm Linux servers running standard iptables or nftables firewalls. Traditional firewalls operate inside the kernel network stack after the device driver has already allocated a socket buffer (sk_buff) structure, parsed Ethernet headers, and dispatched software interrupts (ksoftirqd). Under millions of packets per second, CPU cores spend 100% of their time simply creating and freeing sk_buff memory allocations.

eXpress Data Path (XDP) revolutionizes packet filtering by running eBPF bytecode directly inside the network driver subsystem before memory allocation occurs. An XDP program executes on the raw packet buffer immediately as the network interface card (NIC) DMA transfer completes, dropping malicious packets with zero memory allocation overhead.

Expand

Authoring a High-Performance XDP Filter in C

XDP programs inspect raw memory pointers bounding the packet payload (data and data_end). The BPF verifier strictly verifies all boundary checks before execution.

// xdp_filter.c
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <bpf/bpf_helpers.h>

SEC("xdp")
int filter_malicious_traffic(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    if (eth->h_proto != __constant_htons(ETH_P_IP))
        return XDP_PASS;

    struct iphdr *ip = data + sizeof(*eth);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;

    // Drop malicious scanner traffic targeting closed UDP ports
    if (ip->protocol == IPPROTO_UDP) {
        return XDP_DROP;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

Compiling and Attaching XDP Bytecode

Compile the C source using LLVM Clang with target bpf, then attach the resulting ELF object to your network interface using iproute2:

# Compile to BPF bytecode
clang -O2 -g -target bpf -c xdp_filter.c -o xdp_filter.o

# Attach in native driver mode (or generic mode for testing)
sudo ip link set dev eth0 xdpgeneric obj xdp_filter.o sec xdp

# Verify XDP attachment
ip link show dev eth0
# Output includes: xdpgeneric/id:128 ...

# Detach when maintenance is required
sudo ip link set dev eth0 xdpgeneric off

Packet Inspection and Firewalls Video

Learn how network firewalls examine packet headers and manage state tables in this tutorial:

Production Benchmarks

In benchmark tests simulating 10 million packets per second of UDP floods, standard iptables drops packet throughput to 1.2 Mpps while consuming 100% of 8 CPU cores in ksoftirqd. Under identical conditions, an in-driver XDP program processes 9.8 Mpps while keeping CPU utilization under 15%.

Defend high-traffic endpoints with wire-speed filtering on Netbay cloud servers at netbayhosts.in.