eBPF datapath
also: eBPF forwarding plane, XDP datapath, kernel-native datapath
eBPF datapath refers to the high-performance packet processing pipeline in Linux networking that uses extended Berkeley Packet Filter (eBPF) programs to handle data plane operations like forwarding, filtering, and load balancing without context-switching to kernel space.
eBPF datapath is a modern networking architecture where packet processing decisions happen directly in the kernel using eBPF bytecode. Unlike traditional kernel forwarding which may involve multiple context switches, eBPF programs run in a sandboxed VM and make forwarding decisions at line rate with minimal overhead.
The datapath typically includes hooks at network ingress/egress points where eBPF programs inspect packet headers, update connection state, and apply policies. Common use cases include Cilium (container networking), load balancers (Katran), and service mesh dataplanes that need sub-microsecond latency.
Example: A Cilium network policy program uses eBPF to inspect incoming packets at eth0, check L3/L4 headers against security rules, and either forward or drop the packet—all in kernel space without touching userspace, achieving near-hardware forwarding rates.