BPF Iptables

This work starts from the consideration that the current version of iptables suffers from the linear search algorithm adopted as filtering model, which is not suitable in an environmente where a large set of rules are deployed.

eBPF-iptables provide a faster and more scalable clone of iptables by preserving the original iptables filtering semantic. Our results showed the bpf-iptables outperforms the current version of iptables and nftables by an order of magnitude; in particular when a high number of rules is used.

Multi-core performance comparison with an increased complexity of the firewall rules. Generated traffic (64B UDP packets) is uniformly distributed among all the rules
Sebastiano Miano
Sebastiano Miano
PostDoc Researcher @ QMUL, Ph.D. in Computer Engineering