SR-IOV is good for actual virtualization, but it's pretty clumsy for trying to create isolation within a single VM. For example: - Every VF you create using SR

SR-IOV is good for actual virtualization, but it's pretty clumsy for trying to create isolation within a single VM. For example: - Every VF you create using SR-IOV will need to have a distinct MAC (and thus in practice different IP). But what you'd usually want for this use case is use the same IP for all apps, and do the split by destination port. - Another consequence of the previos point is that all apps would need to include their own support for ARP, DHCP, etc. Doing it centralized doesn't really work. - No promiscuous mode (at least on Intel NICs)m you only get traffic directed to one specific MAC address Now, if you didn't try to use the virtualization support but just use the separate RX/TX queues, with something like the flow director for deciding what traffic gets sent to which queue, you'd get rid of the above problems. But then you end up with the issue that DPDK makes it very hard to have separate applications access the same NIC, even on different queues.