Accelerating the Linux TCP stack via eBPF kernel bypass

Details

Supervisors

Barbette, Tom

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] en sciences informatiques, à finalité spécialisée

Abstract

enThe Linux TCP stack, although feature-complete and extensively tested, imposes a significant per-packet overhead that quickly becomes a bottleneck in high-throughput, low-latency workloads. Existing acceleration techniques either abandon the kernel entirely, sacrificing security, observability, and application compatibility, or preserve the kernel at the cost of modest performance improvements. This thesis explores a middle ground by using eBPF and its XDP and TC hooks to bypass the most expensive parts of the data path while retaining the kernel's control plane, security guarantees, and native tooling. We design and implement a hybrid system combining a small loadable kernel module that exposes the kernel functions necessary for memory management and packet injection with user-supplied eBPF programs. Two bypass variants are presented: a stateless variant that accelerates established flows unconditionally and a stateful variant that interacts with Linux's Netfilter subsystem to implement flow offloading. A comprehensive evaluation of throughput, latency, CPU utilization, and scalability shows that the bypass delivers up to a 4x increase in throughput and reduces CPU cycles per megabyte of throughput by a similar factor in configurations that are usually unfavorable to the standard stack. The results confirm that eBPF provides a safe foundation for TCP acceleration while requiring no modification of existing applications or kernel rebuilds.