xdp-tools

xdp-monitor is a low-overhead monitoring tool powered by BPF tracepoints. It is used to monitor various XDP-related statistics and events. It relies on the BPF raw tracepoints infrastructure in the Linux kernel.

Important Note on Performance: By default, statistics for successful XDP redirect events are disabled. Enabling them via the -s or --stats flag introduces a per-packet BPF tracing overhead. While this overhead is low, it can lead to degradation in packet processing performance.

XDP-bench is a benchmarking utility designed to exercise various XDP (eXpress Data Path) operation modes. It serves as a demonstration tool for different kernel redirection and packet processing capabilities, including:

• Dropping packets: Baseline performance testing.
• Hairpin forwarding: Using XDP_TX to transmit packets back out the same interface.
• Redirection: Using bpf_redirect, cpumap (bpf_redirect_map), devmap (bpf_redirect_map), or multi-device broadcast via devmap.
• AF_XDP: Testing socket-based packet handling via xsk-drop and xsk-tx.

=xdpdump= is a simple packet capture tool designed for debugging XDP programs. It behaves similarly to tcpdump but lacks built-in packet filtering or decoding capabilities.

Key Capabilities

• Capture Points: You can inspect packets at the entry to an XDP program or at its exit. Capturing at the exit allows you to see modified packets and the specific XDP action taken (e.g., XDP_PASS, XDP_DROP).
• Dropped Packets: Because it can capture at the exit point, it can even capture packets that were dropped by the XDP layer.
• Mechanism: It works by attaching a BPF trace program to the XDP entry/exit functions, storing raw packets in a perf trace buffer.
• Fallback: If no XDP program is loaded on the interface, xdpdump falls back to using libpcap for live capture to maintain backward compatibility.

xdp-trafficgen is a high-performance packet generator that utilizes the XDP kernel subsystem to transmit packets through a network interface. Because packets are dynamically generated and transmitted directly in the kernel, it can achieve throughput of millions of packets per second per CPU core.

It supports three primary modes:

1. UDP mode: Generates UDP traffic with fixed or dynamic destination ports (IPv6 only).
2. XSK-UDP mode: Generates UDP traffic using AF_XDP sockets in userspace, useful for benchmarking AF_XDP transmission.
3. TCP mode: Generates dummy TCP traffic on a single flow by intercepting a standard TCP handshake with an ingress XDP program.

The xdp-tools repository provides the libxdp library for interacting with the Linux kernel's eXpress Data Path (XDP) facility, along with several specialized utilities:

• libxdp: The core library for XDP operations.
• xdp-bench: A tool for benchmarking XDP performance.
• xdp-dump: A tool for capturing packets at the XDP layer (similar to tcpdump).
• xdp-filter: A utility for simple packet filtering using XDP.
• xdp-forward: An XDP-based forwarding plane.
• xdp-loader: A CLI utility for loading XDP programs via libxdp.
• xdp-monitor: A tool for monitoring XDP tracepoints.
• xdp-trafficgen: A packet generator based on XDP.
• headers/xdp: Reusable eBPF code snippets (installed to /usr/include/xdp when running make install).

The lib/ directory serves as the central location for shared resources used across the xdp-tools utilities. It contains:

• Common Makefile definitions: Shared build logic used to compile various tools in the repository.
• Common code: Shared source code utilized by different utilities to ensure consistency and reduce duplication.
• libbpf submodule: The lib/libbpf subdirectory is a git submodule that links to the upstream libbpf repository, providing the core BPF loading and management capabilities.

xdp-forward is an XDP forwarding plane designed to accelerate packet forwarding using XDP. It works by loading XDP programs onto a set of specified interfaces. The userspace component configures these programs to forward packets between the interfaces using XDP_REDIRECT, utilizing the kernel routing table or netfilter flowtable to determine destinations.

Packets that xdp-forward cannot forward are passed up to the standard networking stack for kernel handling. The specific behavior for these packets depends on the selected Operating Mode.

To support multiple XDP programs on one interface, libxdp uses a dispatcher. You can control how programs interact using metadata embedded via BTF in the ELF file using the XDP_RUN_CONFIG macro.

Metadata Concepts

• Run priority: An integer used to sort programs. Lower values run earlier (e.g., filters), higher values run later (e.g., counters). Default is 50.
• Chain call actions: A list of return codes that, if returned by a program, signal the dispatcher to continue to the next program in the chain. If a program returns anything else, processing stops. Default is XDP_PASS.

Specifying Metadata in C

Use xdp_helpers.h to include configuration in your BPF program:

#include <bpf/bpf_helpers.h>
#include <xdp/xdp_helpers.h>

struct {
	__uint(priority, 10);
	__uint(XDP_PASS, 1);
	__uint(XDP_DROP, 1);
} XDP_RUN_CONFIG(my_xdp_func);

The --fwd-mode option determines how packets are forwarded:

• fib (default): Performs a lookup in the kernel routing table (FIB) for each packet. If the lookup fails, the packet is passed to the kernel stack. This mode bypasses the netfilter subsystem, meaning firewall rules are not checked. Note that packets requiring neighbor discovery will periodically pass to the kernel stack.
• flowtable: Offloads netfilter sw flowtable logic to the XDP layer (if hardware flowtable is unavailable). Currently, it can offload TCP or UDP netfilter flowtable entries. The user must configure the flowtable separately via nftables.

The --fib-mode option determines how the kernel routing table lookup is performed:

• full (default): Performs a full lookup in the kernel routing table, applying any user-configured policy routing rules.
• direct: Performs a lookup using the BPF_FIB_LOOKUP_DIRECT flag. This skips policy routing rules, which can improve performance but means policy rules will be ignored.