How to Use XDP and eBPF to Accelerate IPSec Throughput by 400%
Talkat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 14:05· Salt Palace | Level 1 | Grand Ballroom B·
summary
A practical POC injects a 3‑byte inner‑packet hash into the ESP SPI and uses the xtp/BPF redirect helper to steer decrypted packets to CPUs, implemented in under 200 lines of C and relying on XDP/eBPF and the xtp redirect map. Benchmarks on a 3‑node, 8‑core, 25Gb NIC cluster show up to 412% p99 improvement (about 4x throughput at scale) but costs include broken ICV visibility, SPI repurposed for 3‑byte hash, uneven CPU distribution and the need for NICs that support native xtp/XDP.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:27IPSec bottleneck with RSS
- 4:19IPSec tunnels and RSS limits
- 6:04Solving RSS with eBPF/XDP
- 11:52eBPF-based receive side scaling
- 12:56Benchmarking with netperf
- 15:45CPU usage analysis
- 17:11Pros, cons, security
- 19:41Future improvements
- 20:44Q&A
related talks
37mEfficient and Flexible Virtual Machine Networking Through eBPF
32meBPF: BPF kernel infrastructure
33mBringing packet queueing to XDP
28mXDP for TSN
46mConquering the Linux network stack: decapsulating packets with eBPF at 6Mpps+
26mFaster Software Packet Processing on FPGA NICs with eBPF Program Warping
42mAccelerating Envoy with the Linux Kernel
16mElectrode: Accelerating Distributed Protocols with eBPF