XDP
also: eXpress Data Path
XDP (eXpress Data Path) is a Linux kernel technology that allows programs to process network packets at the earliest possible point in the network stack, before they reach the traditional networking subsystem.
XDP is a high-performance packet processing framework that runs eBPF (extended Berkeley Packet Filter) programs directly in the network driver or NIC firmware. This allows near-wire-speed packet inspection and manipulation with minimal overhead.
XDP operates at three levels: in the NIC driver (DRV mode), in the NIC hardware itself (HW mode), or with a fallback for drivers that don't support it (SKB mode). Packets can be dropped, redirected, or passed to the kernel—all before the kernel allocates memory for traditional network stack processing.
Common use cases include DDoS mitigation, load balancing, and packet filtering. For example, an XDP program can drop malicious traffic immediately:
int xdp_drop(struct xdp_md *ctx) {
return XDP_DROP;
}XDP complements eBPF and is particularly valuable in scenarios requiring extreme throughput or ultra-low latency, such as packet-processing appliances and high-speed security gateways.