Cloudflare's eBPF Series Part 2: Closing Gaps in Linux Networking APIs

In the second installment of its eight-year eBPF retrospective, Cloudflare details the specific points where standard Linux networking APIs failed to meet its scale, visibility, and reliability needs — and the custom tooling built to close those gaps. The company auto-mitigated a record 3.8 Tbps DDoS attack using this eBPF-based stack.

L4Drop uses the XDP hook to drop packets directly at the NIC driver layer, before the kernel network stack is even touched, sustaining over 10 million packets per second on a single CPU at roughly 10% overhead. Because this bypasses standard debugging tools like tcpdump, the team built xdpcap to expose XDP-layer traffic with familiar pcap-compatible filtering. To solve the wildcard-bind and port-sharing limitations across millions of IPs and 65,535 ports, Cloudflare contributed the sk_lookup hook upstream and built Tubular, enabling restart-free, programmable socket dispatch.

The cbpfc compiler translates classic BPF filter syntax into eBPF bytecode to support arbitrary packet matching — such as p0f signatures and cross-header comparisons — that can't be expressed with standard eBPF maps due to verifier loop restrictions. flowtrackd complements this with unidirectional TCP flow tracking for asymmetric routing scenarios where iptables conntrack falls short.

For engineers running large-scale network infrastructure, these details illustrate eBPF not just as a performance optimization but as a genuine platform for safely extending kernel behavior at scale.