eBPF vs iptables: How Cilium Accelerates Microservice Networking by 400%
Bypassing Linux TCP/IP stack overhead with socket-layer eBPF bytecode programs.
Table of Contents (30 Concepts)
1. Why Traditional iptables Collapse Under Scale
iptables performs sequential linear rule evaluation for every incoming packet. When a cluster scales to thousands of pods and services, evaluating 20,000+ sequential rules introduces severe CPU latency spikes.
"Imagine having to check a 50-page printed guest list line by line for every single person who knocks at the door, instead of looking up their name in a fast digital tablet directory."
[ iptables: O(N) Linear Traversal ]
Packet ──> [ Rule 1 ] ──> [ Rule 2 ] ──> ... ──> [ Rule 20,000 ] ──> Pod
(High CPU spikes under 10k+ services)2. The Linux Kernel Networking Datapath Bottleneck
Standard socket packet traversal requires copying buffers between kernel and user-space, passing through netfilter hooks, routing tables, and IP connection tracking (conntrack).
"Driving through 10 toll gates in a 5-mile stretch of road."
3. eBPF Architecture: Verified Sandboxed In-Kernel Bytecode
eBPF allows developers to run sandboxed mini-programs directly in the Linux kernel without changing kernel source code or loading untrusted modules.
4. Socket-Layer BPF Programs (sockops & sk_msg)
eBPF sockops programs attach directly to TCP socket creation hooks. When two local pods communicate on the same node, eBPF redirects packets directly between their socket queues, bypassing the entire network stack.
5. XDP (eXpress Data Path): Dropping Packets at the NIC Driver
XDP runs eBPF programs at the lowest possible level—directly inside the network card (NIC) driver before the kernel even allocates an sk_buff structure.
6. Cilium eBPF Service Routing vs Kube-Proxy
Cilium replaces kube-proxy with O(1) BPF map lookups, ensuring packet forwarding latency remains strictly constant regardless of how many services exist in the cluster.
7. BPF Map Memory Structures & Hash Ring Lookups
BPF maps are efficient key/value memory storage structures shared between the kernel program and user-space control plane agents.
Subscribe to continue reading the full masterclass
You’ve finished the first 7 concepts. Join 120,000+ senior engineers to unlock the remaining 23 concepts, deep-dive trade-off diagrams, and our 120+ edition archive.