Re:IP Accounting and Access Lists with Systemd
by sandGorgon on Tuesday October 10, 2017 @05:20AM
(#15440466)
What is the general direction of packet filtering in Linux - it seems that it is nftables vs ebpf/XDP at this point. In fact https://lwn.net/Articles/609571/
>There was "a brawl" at the workshop about possibly replacing the nftables virtual machine with eBPF, but there is one major show-stopper in any such plan: nftables allows partial replacement of a firewall configuration, while eBPF, in its current form, would not.
>There was "a brawl" at the workshop about possibly replacing the nftables virtual machine with eBPF, but there is one major show-stopper in any such plan: nftables allows partial replacement of a firewall configuration, while eBPF, in its current form, would not.
Cloudflare, Netflix, Facebook, etc are all using eBPF via XDP https://www.iovisor.org/technology/ebpf
eBPF and XDP are supported seamlessly on kernel 4.12 and later.