3 ms·

Any reason this article completely skipped over the userspace tools like DPDK and Netmap (there are many others). Considering cloudflare uses a customer version

• majke 8y ago
  Apples and oranges. Most important problem with DPDK and Netmap is that they require a dedicated network card. We don't have a network card to spare for each of our applications. Read on more: https://blog.cloudflare.com/kernel-bypass/ https://blog.cloudflare.com/kernel-bypass/ https://blog.cloudflare.com/single-rx-queue-kernel-bypass-with-netmap/ https://blog.cloudflare.com/single-rx-queue-kernel-bypass-wi... Also using dpdk and netmap kills usual tooling (from basics like tcpdump). We very much like iptables, xdp, conntrack, syn cookies and other technologies deeply embedded into linux kernel. Doing DDoS once on linux kernel is hard enough. We don't want to redo the logic for each of the possible kernel bypasses technologies: https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp-stack/ https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp... https://blog.cloudflare.com/syn-packet-handling-in-the-wild/ https://blog.cloudflare.com/syn-packet-handling-in-the-wild/