What is Linux XDP (eXpress Data Path) and how does it achieve 24+ million packets per second?

XDP is a programmable, bare-metal packet processing framework built natively into the Linux kernel network subsystem. Unlike traditional Linux socket networking—where the kernel driver must allocate an sk_buff (SKB) metadata structure (which costs 1,500+ CPU cycles per packet) and traverse iptables/nftables, netfilter hooks, and routing tables—XDP executes an in-kernel eBPF program directly inside the network interface card (NIC) driver receive ring before memory allocation. Operating at this earliest possible execution point allows a single modern CPU core to inspect, modify, redirect, or drop up to 24 million packets per second (Mpps), achieving full line-rate performance on 10GbE, 25GbE, 40GbE, and 100GbE links.

What is the operational difference between XDP Driver (Native) Mode, SKB (Generic) Mode, and Offload Mode?

XDP supports three distinct deployment modes controlled via flags in the netlink interface: (1) Native / Driver Mode (XDP_FLAGS_DRV_MODE): The eBPF bytecode is injected directly into the NIC driver poll routine (NAPI) before sk_buff allocation. This provides peak throughput (15-24M pps/core) and is supported by drivers like i40e, mlx5, ixgbe, virtio_net, and veth. (2) Generic / SKB Mode (XDP_FLAGS_SKB_MODE): The program executes further up the stack after the kernel has already allocated an sk_buff. It works across any network driver without hardware support, but drops throughput to 2-4M pps/core, making it primarily useful for local testing and CI/CD verification. (3) Offload Mode (XDP_FLAGS_HW_MODE): The eBPF bytecode is JIT-compiled directly onto a SmartNIC ASIC/FPGA (e.g. Netronome, AMD/Pensando, Nvidia BlueField), executing on the card with zero host CPU utilization.

How does AF_XDP (XSK) achieve zero-copy packet transfer between kernel space and user space?

AF_XDP (Address Family XDP) provides an ultra-fast raw packet transport channel directly into user-space applications (such as Suricata, DPDK, Envoy, or custom Go/Rust engines) without bypassing the Linux kernel. It utilizes a user-space allocated memory region called UMEM registered via setsockopt(fd, SOL_XDP, XDP_UMEM_REG). Communication occurs through four lockless, single-producer single-consumer circular descriptor rings: (1) Fill Ring (user supplies free UMEM frame addresses to kernel), (2) Rx Ring (kernel notifies user of received packets with buffer offsets), (3) Tx Ring (user submits packets for transmission), and (4) Completion Ring (kernel reports sent packets so user space can reclaim frames). In zero-copy mode (XDP_ZEROCOPY), the NIC DMA engine writes packet bytes directly into UMEM, eliminating all memcpy operations.

Why does the in-kernel eBPF verifier strictly reject packet parsers without bounds checks?

In an XDP program, the packet is passed as a struct xdp_md containing pointers to the packet memory: ctx->data (start of packet) and ctx->data_end (end of packet). Because raw network packets can arrive truncated, fragmented, or malformed, reading beyond ctx->data_end causes an invalid kernel memory read, which could crash the host. The eBPF verifier performs strict mathematical range tracking on every register: before any memory load or store instruction into packet data, the verifier mandates an explicit conditional check (e.g., if (data + sizeof(struct ethhdr) > data_end) return XDP_DROP;). If a single branch lacks this guard, the verifier terminates loading with "invalid access to packet, off=14 size=20, R2(id=0,off=0,r=0)".

How do BPF_MAP_TYPE_DEVMAP and BPF_MAP_TYPE_CPUMAP scale packet forwarding?

When an XDP program returns XDP_REDIRECT, it specifies a destination target using specialized BPF maps. (1) BPF_MAP_TYPE_DEVMAP redirects packets directly to another network interface (e.g. for bridging, routing, or tunneling between physical NICs and container veth pairs) with zero SKB allocation. (2) BPF_MAP_TYPE_CPUMAP redirects packets across CPU cores. When a single NIC RX queue is saturated by high traffic, the initial core inspects the packet at XDP level and pushes it to a target CPU core specified in CPUMAP. The target CPU then allocates the SKB and processes the TCP/IP stack, effectively load balancing high packet rates across all host cores.

What are the five canonical XDP return actions and when should each be used?

An XDP program terminates by returning one of five integer verdict codes: (1) XDP_DROP (1): Instantly discards the packet in the driver ring without allocating memory; ideal for volumetric DDoS mitigation. (2) XDP_TX (2): Bounces the packet back out the same physical interface it arrived on; used for hairpinned load balancing, ICMP echo responders, or ARP proxies. (3) XDP_REDIRECT (3): Forwards the packet to another NIC, CPU core, or AF_XDP socket via bpf_redirect_map(). (4) XDP_PASS (4): Hands the packet to the standard Linux network stack for normal socket delivery. (5) XDP_ABORTED (0): Signals an internal program error, discards the packet, and increments the xdp:xdp_exception kernel tracepoint.

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Linux Kernel 5.4+ / 6.x 24M pps Bare-Metal Data Plane AF_XDP Zero-Copy UMEM 67ns Packet Budget

Linux eBPF XDP, AF_XDP & High-Speed Packet Processing Studio

An architectural deep-dive, wire-speed mathematical modeler, and production code synthesizer for Linux high-speed packet processing. Simulate native vs generic driver modes, compute wire-rate packet processing budgets down to clock cycles per packet, model AF_XDP zero-copy UMEM ring buffers, and synthesize production C, Go, and Rust network engines.

14.88 Mpps

Wire Rate (10 Gbps @ 64B)

67.2 ns

Packet Inter-Arrival Time

201 cycles

CPU Budget @ 3.0 GHz

XDP_DROP (48 cyc)

Mitigation Cost / Headroom

Ethernet Line-Rate & Per-Packet Cycle Budget Calculator

Calculate physical layer wire packet rates, inter-frame gap overhead, nanosecond budgets, and compare standard Linux kernel TCP/IP stack overhead against eBPF XDP.

Physical Link Speed

Ethernet Frame Size (Payload + L2/L3)

CPU Core Clock Speed (GHz)

Physical Wire Encoding Math (IEEE 802.3 Standard)

Calculating line-rate physics...

Throughput & Latency Headroom: Linux Stack vs XDP

Processing Architecture	CPU Cycles / Packet	Max Single-Core PPS	10 GbE 64B Line Rate Status	Failure / Drop Behavior
Standard Linux Kernel (iptables/nftables)	~ 1,600 – 2,200 cycles	1.4 – 1.8 Mpps	Drops ~88% of Packets	ksoftirqd spins at 100% CPU, drops packets in NIC ring buffer.
Linux TC (Traffic Control cls_bpf)	~ 650 – 900 cycles	3.3 – 4.5 Mpps	Drops ~70% of Packets	Allocates sk_buff, runs after driver NAPI poll.
eBPF XDP (Native / Driver Mode)	~ 45 – 80 cycles	18.0 – 24.0 Mpps	100% Line Rate (Zero Drops)	Drops or filters packets in driver before memory allocation.
XDP Offload (SmartNIC Hardware)	0 host CPU cycles	Line Rate (40G / 100G)	100% ASIC Wire Rate	Executed entirely on NIC processor without host interruption.

AF_XDP (XSK) Zero-Copy UMEM Descriptor Rings Simulator

AF_XDP transfers raw Ethernet frames into user-space applications without kernel memory copies via four lockless single-producer single-consumer circular descriptor rings.

UMEM Frame Size

Ring Size (Descriptors)

Driver Zero-Copy Mode

Ring 1: Fill Ring (User -> Kernel: Free Frame Addresses) 16 Frames Available

Ring 2: Rx Ring (Kernel -> User: Packet Ready Descriptors) 0 Delivered Packets

The 4-Ring UMEM Handshake Protocol

Why 4 Rings? Standard ring buffers have one producer and one consumer. Because AF_XDP requires bidirectional zero-copy packet flow between kernel driver space and unprivileged user space, two rings manage incoming ingress (Fill + Rx) and two rings manage outgoing egress (Tx + Completion).

Ring Name	Producer	Consumer	Descriptor Payload	Operational Responsibility
Fill Ring	User Application	NIC Kernel Driver	`uint64_t addr`	Supplies unpopulated UMEM memory addresses for the NIC DMA engine to write incoming packets into.
Rx Ring	NIC Kernel Driver	User Application	`struct xdp_desc { addr, len, options }`	Delivers received packet location and byte length to user space.
Tx Ring	User Application	NIC Kernel Driver	`struct xdp_desc { addr, len, options }`	Submits outgoing packets from UMEM to the NIC transmit queue.
Completion Ring	NIC Kernel Driver	User Application	`uint64_t addr`	Notifies user space that packet transmission has finished so the UMEM frame can be reused.

eBPF In-Kernel Verifier Bounds Check Simulator

The eBPF verifier tracks variable register bounds. If your code accesses packet memory without verifying data + header_size <= data_end, the kernel rejects the program at load time.

Packet Parser Implementation

Kernel Verifier Log Level

Simulated Kernel Verifier Static Analysis Output (bpf_prog_load)

Analyzing eBPF instructions...

Architectural Ingress Path: XDP vs Linux TC vs DPDK

Selecting between XDP, Traffic Control, and DPDK dictates whether your infrastructure maintains standard Linux management tools or sacrifices kernel capabilities for raw speed:

Feature / Dimension	XDP (eXpress Data Path)	Linux TC (Traffic Control)	DPDK (Data Plane Dev Kit)
Execution Point	NIC Driver RX NAPI poll routine	After `sk_buff` allocation (qdisc)	User-space PMD (Poll Mode Driver)
Linux Kernel Bypass?	No (In-Kernel Safe)	No (In-Kernel Safe)	Yes (Total Bypass)
Standard Linux Tools (ss, ping, tcpdump)	Works seamlessly via `XDP_PASS`	Fully functional across all tools	Broken (NIC unbinds from kernel)
Throughput per Core	18 – 24 Million PPS	3 – 5 Million PPS	20 – 30 Million PPS
Host CPU Utilization at Idle	0% (Interrupt/NAPI driven)	0% (Standard kernel threads)	100% (Continuous busy-polling)
Safety & Crash Immunity	eBPF Verifier guaranteed crash-free	eBPF Verifier guaranteed crash-free	Raw C pointers (Segfaults crash app)

Production Implementation Blueprints

Syntax-validated, memory-safe implementations for high-speed packet processing in C, Go, and Rust.

// Select a blueprint above

Linux eBPF XDP, AF_XDP & High-Speed Packet Processing Studio

Ethernet Line-Rate & Per-Packet Cycle Budget Calculator

Throughput & Latency Headroom: Linux Stack vs XDP

AF_XDP (XSK) Zero-Copy UMEM Descriptor Rings Simulator

The 4-Ring UMEM Handshake Protocol

eBPF In-Kernel Verifier Bounds Check Simulator

Architectural Ingress Path: XDP vs Linux TC vs DPDK

Production Implementation Blueprints

🔍 Companion Workbenches & Verification Tools

Linux Continuous Profiling, Stack Unwinding & FlameGraph Studio

Database WAL, ARIES Recovery Algorithm & Checkpointing Studio

Linux io_uring Zero-Copy Network I/O Studio: Kernel Bypass & Registered Buffers

Linux Page Faults, Copy-on-Write (COW) & VMA Allocator Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions