What is the architectural difference between eBPF XDP, eBPF TC (clsact), and Netfilter in the Linux kernel?

The Linux networking stack processes packets through three distinct interception layers: (1) eBPF XDP (eXpress Data Path): Executes at the lowest possible layer directly in the network card driver or hardware offload BEFORE the kernel allocates an sk_buff data structure. XDP is RX-only and delivers maximum throughput (18–24M pps/core) for DDoS mitigation, but lacks egress support and packet metadata; (2) eBPF TC (Traffic Control / clsact): Attached to the kernel queuing discipline (qdisc) layer via the clsact pseudo-qdisc. TC operates on fully formed sk_buff structures on BOTH ingress and egress. It can modify packet headers (L2–L4), mangle IP/port fields, change packet length via bpf_skb_adjust_room(), and perform zero-copy redirection (bpf_redirect()); (3) Netfilter / iptables: Sits higher in the kernel IP stack across 5 predefined hooks (PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING), evaluating sequential rules and maintaining bidirectional connection tracking state via nf_conntrack.

How does Netfilter Connection Tracking (nf_conntrack) work and what causes table exhaustion in Kubernetes?

The Linux conntrack subsystem tracks the state of all network sessions passing through the kernel. A hash table of buckets (hashsize) stores bidirectional connection tuples (src_ip, dst_ip, src_port, dst_port, protocol). Each connection consumes an nf_conn struct (typically 320 to 384 bytes in kernel slab cache). The table capacity is bounded by nf_conntrack_max. In high-concurrency microservice clusters or during port scans/DDoS floods, the number of tracked states can reach nf_conntrack_max. When this occurs, the kernel logs "nf_conntrack: table full, dropping packet" and silently discards all subsequent incoming and outgoing packets, regardless of available CPU or network bandwidth. Modern container networks avoid this by tuning hashsize = nf_conntrack_max / 4 and using eBPF TC to bypass conntrack entirely for pod-to-pod east-west traffic.

How does eBPF BPF Host Routing (Cilium pattern) bypass the standard TCP/IP stack to cut latency by 50%?

In standard container networking (e.g. Flannel or Calico without eBPF), a packet sent from a container must traverse a virtual ethernet pair (veth), enter the host network namespace, pass through multiple Netfilter iptables chains (mangle, nat, filter), execute route lookups, traverse connection tracking twice, and finally exit through the physical NIC. This route incurs massive CPU cache misses and memory copies. With eBPF BPF Host Routing (developed by Cilium), an eBPF program attached to the container veth TC ingress hook intercepts the packet, inspects the destination IP, consults an eBPF LPM (Longest Prefix Match) trie map, rewrites MAC addresses, and calls bpf_redirect() directly to the physical network interface. The packet completely bypasses iptables, conntrack, and the host IP stack, cutting latency in half and saving up to 30% CPU overhead.

What do the return codes TC_ACT_OK, TC_ACT_SHOT, and TC_ACT_REDIRECT mean in eBPF TC classifiers?

An eBPF program attached to the clsact qdisc returns a 32-bit integer indicating to the Linux kernel how to process the current sk_buff: (1) TC_ACT_OK (0): Tells the kernel to accept the packet and allow it to proceed along its normal networking path; (2) TC_ACT_SHOT (2): Instructs the kernel to immediately drop and free the sk_buff, dropping the packet without logging an error; (3) TC_ACT_UNSPEC (-1): Matches default qdisc action or falls through to subsequent classifiers in the chain; (4) TC_ACT_REDIRECT (7): Used in conjunction with helper functions like bpf_redirect(ifindex, flags) or bpf_redirect_peer(ifindex, flags) to bypass normal routing and forward the packet directly to another network device or container interface.

How do Token Bucket Filter (TBF) and FQ-CoDel queuing disciplines prevent bufferbloat?

Bufferbloat occurs when network routers or host queues buffer large amounts of data during congestion, creating seconds of latency while preventing TCP congestion control from throttling back. Linux Traffic Control mitigates this using two strategies: (1) Token Bucket Filter (TBF): A classical rate-limiting qdisc that accumulates tokens at a configured rate (e.g. 100 Mbps) up to a burst limit. Packets can only be transmitted when sufficient tokens exist; excess packets are queued or dropped, enforcing strict traffic shaping. (2) FQ-CoDel (Fair Queuing with Controlled Delay): A modern Active Queue Management (AQM) algorithm. It classifies packets into multiple sub-queues based on 5-tuple hash to ensure fairness between flows, and tracks the sojourn time (time a packet spends sitting in the queue). If the minimum sojourn time exceeds a target (typically 5 ms) over an interval (100 ms), FQ-CoDel proactively drops packets at the head of the queue, signaling TCP senders to slow down before deep buffers form.

How do you size the Linux nf_conntrack hash table and kernel memory for 1,000,000 concurrent connections?

To support 1,000,000 concurrent connections without hash bucket chaining degradation: (1) Sizing hashsize: The recommended ratio is 1 bucket per 4 connections, giving hashsize = 1,000,000 / 4 = 250,000 buckets (typically rounded up to a power of 2, e.g. 262,144 buckets). (2) Setting nf_conntrack_max: Set to 1,000,000. (3) Calculating kernel memory: Each hash bucket pointer consumes 8 bytes (pointer size on 64-bit systems), so the hash table consumes 262,144 * 8 = ~2 MB. Each tracked connection consumes an nf_conn struct (320 bytes), plus two timer/extension structures (~64 bytes), totaling ~384 bytes per connection. For 1,000,000 active connections, the memory overhead is 1,000,000 * 384 bytes = ~384 MB of unswappable kernel slab RAM. Ensure the system has at least 1–2 GB of free physical RAM allocated for networking overhead.

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

eBPF clsact BPF Host Routing nf_conntrack Tuning

Linux eBPF Traffic Control (TC), Netfilter & Conntrack Architecture Studio

Architect high-throughput Linux kernel packet pipelines: evaluate packet traversal across XDP, eBPF TC (clsact), and Netfilter hooks, calculate nf_conntrack hash table memory footprints and table exhaustion thresholds, model BPF Host Routing latency bypasses, and export production C eBPF classifiers.

262,144

Active Conntrack Sessions

1,048,576

nf_conntrack_max Limit

384.0 MB

Kernel Slab Memory

BPF Host Routing

Packet Datapath Mode

-52.4%

Datapath Latency Reduction

TC_ACT_REDIRECT

eBPF TC Action Code

1. Linux Kernel Packet Traversal & BPF Bypass Pipeline

Observe how eBPF TC bypasses Netfilter, iptables, and conntrack to deliver direct packet routing

NIC Driver
XDP Hook (Bare-Metal)

→

sk_buff Alloc
Socket Buffer

→

eBPF TC Ingress
clsact (qdisc)

→

PREROUTING
Netfilter conntrack

→

Routing Decision
Kernel FIB Trie

→

POSTROUTING
iptables SNAT/MASQ

→

eBPF TC Egress
Shaping / FQ-CoDel

→

Egress NIC
Hardware Transmit

BPF Host Routing active: eBPF TC intercepts packets at ingress, looks up endpoint map, rewrites L2 MACs, and calls bpf_redirect_peer() directly to container veth. Netfilter PREROUTING and iptables completely bypassed.

2. Conntrack (nf_conntrack) Table Sizing & Exhaustion Calculator

Target Max Connections (nf_conntrack_max)

Current Active Flows: 262,144

Hash Table Bucket Ratio

Conntrack Table Occupancy (25.0% Capacity)

262,144 Active

786,432 Free Buckets

Linux eBPF Traffic Control (TC), Netfilter & Conntrack Architecture Studio

1. Linux Kernel Packet Traversal & BPF Bypass Pipeline

2. Conntrack (nf_conntrack) Table Sizing & Exhaustion Calculator

3. Production eBPF TC & Kernel Tuning Blueprints

🔍 Companion Workbenches & Verification Tools

URL Parser & Query String Parameter Inspector

Distributed Tracing, OpenTelemetry & W3C TraceContext Studio

Linux Page Cache Writeback & Dirty Throttling Studio

SQL Execution Plan (EXPLAIN) Analyzer & Index Optimization Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions