This document provides an introduction to eBPF (Extended Berkeley Packet Filter), which allows running user-space code in the Linux kernel without needing to compile a kernel module. It describes how eBPF avoids unnecessary copying of packets between kernel and user-space for improved performance. Examples are given of using eBPF for networking tasks like SDN configuration, DDoS mitigation, intrusion detection, and load balancing. The document concludes by noting eBPF provides alternatives to iptables that are better suited for microservices architectures.

1. Introduction to eBPF
Network Applications
Roger Coll - 3/12/2020
Universitat Politècnica de Catalunya

2. Linux Kernel
◉ Free and open-source
◉ Modular
◉ Multitasking
◉ Monolithic
◉ Written in C
About 33% of web servers use Linux as OS !

3. Monolithic Kernel
- The entire OS is working in the Kernel space
- All OS code runs in privileged mode
- High performance, but higher risk for system
crash

5. What is BPF?
Berkeley Packet Filter is a small virtual machine that can run
programs injected from the user space in the kernel space
without changing/recompiling the kernel code.
- First implementation (BPF) => Linux Kernel 3.15 (1992)
- Better known as the packet filter language for tcpdump

6. BPF workflow
tcpdump -d

7. Any benefit?
- Avoids copying unwanted packets from the OS to the
process/user space.
Huge impact on performance

8. So… what is eBPF?
- Extended Berkeley Packet Filter
- Fast and safe, in-kernel, register based, bytecode VM
- Linux Kernel 3.18 (2014)
Run code in the kernel without having
to write a kernel module.

9. BPF eBPF
- 32-bit
- Fixed length instructions
- One accumulator
- One index register
Arithmetic operations on the packets
data, compare and decide (accept/reject)
- 64-bit
- 512 byte stack
- Maps (key/value)
Wide range of applications

10. eBPF features
- Much more than just filtering packets
- bpf() syscall => run program developed in user space in
the kernel
C (limited) eBPF (Bytecode) Machine code
Kernel
JIT
compiler

12. Hello World
+ Kprobes example

13. Time to rethink the Kernel

14. From monolithic to microkernel or kernel with microservices

16. Network use cases
- SDN configuration
- DDos mitigation (cloudflare)
- Intrusion detection
- Network security at application layer => Cilium k8s
- Load balancing (facebook data centers)
- Servers performance

17. Iptables has not been designed for micro services

18. XDP throughput
IPVS throughput

19. Any questions ?
Thanks!