How We Built Our Own Netfilter with Intel DPDK and Prefix Trees
summary
Describes building a custom packet-filtering engine based on Intel DPDK and prefix trees as an alternative to Linux Netfilter. Covers using DPDK for high-performance packet I/O and implementing prefix-tree data structures for efficient rule matching to replace or augment Netfilter in high-throughput systems.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:55Existing solutions problems
- 4:22Stress traffic performance
- 8:18Kernel optimization approaches
- 10:46User space choice
- 14:40New Netfilter goals
- 15:24Linear rule dependency issue
- 18:38Terminal rule transformation
- 21:50Filtering and routing merge
- 26:26Rule translation optimization
- 28:53Test results
- 29:35System integration
- 33:10Summary
- 34:01Q&A
related talks
38mTelecom Packet Processing and Correlation Engine Using DPDK
31mFlow-based Packet Processing Framework on DPDK and VPP
36mRunning High-performance User-space Packet Processing Apps in Kubernetes
25mDPDK performance optimization for edge computing scenario
19mGet start with XDP: write a network filter in 10m
33mAdvanced rp_ filter
22mMonitoring 400G Traffic in DPDK Using FPGA-Based SmartNIC with RTE Flow
19mDINT: Fast In-Kernel Distributed Transactions with eBPF