The main reason for the difference is that there's just a lot less code being executed. The XDP code runs very early on, basically immediately after the nic rec

The main reason for the difference is that there's just a lot less code being executed. The XDP code runs very early on, basically immediately after the nic receives the packet. The XDP hook is placed in the NIC driver just after the interrupt processing and before any memory allocation needed by the network stack itself. It is not being sent up the Kernel. So all this happens before an SKB (the most fundamental data structure in the Linux networking code) is allocated. Practically this means this is executed before things like tc and iptables. Less code, much faster.