XDP

XDP stands for eXpress Data Path, a component of the Linux kernel that enables high-speed packet processing by running small eBPF programs at the earliest point in the receive path. Its goal is to reduce latency and CPU overhead compared with the traditional network stack, enabling tasks such as filtering, shaping, steering, and DDoS mitigation to be applied before the kernel network stack.

An XDP program is a BPF program loaded via the BPF verifier and attached to a network interface at the XDP hook. When a packet is received, the kernel runs the program; the program returns an action that determines the next step: XDP_PASS to hand the packet to the standard stack, XDP_DROP to drop, XDP_TX to transmit on the same interface, or XDP_REDIRECT to forward to another interface or to a designated BPF map. Programs may use maps to track state or share data.

XDP supports native mode, where packets are processed in the kernel's fast path; a generic mode that provides portability across devices; and an optional hardware offload where supported by NICs to run XDP on the device itself for even lower latency. The offload has limitations based on hardware capability and driver support.

Common use cases include traffic filtering, rate limiting, basic load balancing, and rapid mitigation of simple attacks. Because the processing happens before the main kernel network stack and can happen in hardware, XDP can deliver lower latency and higher throughput on supported hardware and configurations.

Ecosystem: XDP is part of the Linux kernel and is tightly integrated with the eBPF toolchain, libbpf, and the BPF verifier. It is supported by a growing set of drivers and tooling for development and measurement.