A BPF map for online packet classification
summary
A new single BPF wildcard map implements a hash‑based tuple/Double‑Merge classifier in kernel land with a user API described via a BTF/wildcard descriptor passed at map create and libbpf macros to generate that descriptor. Benchmarks show lookups around ~120 ns for 100k four‑tuple IPv4 rules (unsuccessful lookups cost ~2×), preallocated maps hit ~100 ns for lookups and updates, and non‑preallocated updates sit under a half‑microsecond. It supports port ranges and outperforms LPM for simple prefix cases.
AI-written summary · about
chapters (12)
- 0:00Introduction to BPF packet classification
- 1:50Use cases in Siloam ecosystem
- 5:28Packet classification algorithms overview
- 7:34Hash-based Tuple space search
- 10:48Tuple merge optimizations
- 14:24Static table allocation trade-offs
- 17:19API design decisions
- 18:24Map definition and usage example
- 23:26Kernel changes required
- 24:10Performance benchmarks results
- 27:45Summary and future work
- 28:14Q&A session
related talks
32meBPF: BPF kernel infrastructure
34mWhat's new in the BPF world?
17mPlanB: Efficient Software IPv6 Lookup with Linearized B+-Tree
23mImplement simple local DNS server with BPF
26mContainer Networking: The Play of BPF and Network NS with different...
17mLightning Talk: eBPF based UPF (User Plane Function) for 5G
16mGRO Library Enhancements
32mDemystifying eBPF - eBPF Firewall from scratch