Calico Dataplane: iptables vs eBPF

Calico Dataplane: iptables vs eBPF An architecture diagram generated by Archify. NIC · packet ingress · iptables dataplane (Legacy) · O(N) rule evaluation NIC packet ingress PREROUTING · raw · mangle · nat + conntrack · iptables dataplane (Legacy) · O(N) rule evaluation PREROUTING raw · mangle · nat + conntrack FORWARD · mangle · filter · iptables dataplane (Legacy) · O(N) rule evaluation FORWARD mangle · filter kube-proxy iptables rules · Service LB (DNAT) · iptables dataplane (Legacy) · O(N) rule evaluation · O(N) rule evaluation kube-proxy iptables rules Service LB (DNAT) O(N) rule evaluation POSTROUTING · mangle · nat · iptables dataplane (Legacy) · O(N) rule evaluation POSTROUTING mangle · nat Destination Pod · high latency · iptables dataplane (Legacy) · O(N) rule evaluation Destination Pod high latency Source Pod · app socket · connect() · eBPF dataplane (Modern) · O(1) map lookup Source Pod app socket · connect() Connect-time LB · cgroup connect() hook · socket level · eBPF dataplane (Modern) · O(1) map lookup · no kube-proxy · DSR capable Connect-time LB cgroup connect() hook · socket level no kube-proxy · DSR capable veth TC Hook · one BPF program: policy + routing · eBPF dataplane (Modern) · O(1) map lookup veth TC Hook one BPF program: policy + routing BPF Maps · Policy · Service/NAT · Endpoint · eBPF dataplane (Modern) · O(1) map lookup · O(1) map lookup BPF Maps Policy · Service/NAT · Endpoint O(1) map lookup Destination Pod · low latency · eBPF dataplane (Modern) · O(1) map lookup Destination Pod low latency multiple chain traversals connect(VIP) dest rewritten map lookup single processing path iptables dataplane (Legacy) · O(N) rule evaluation eBPF dataplane (Modern) · O(1) map lookup Legend iptables BPF map eBPF prog Endpoint

iptables mode

  • • Every packet traverses multiple chains, so latency is high
  • • Rules are matched sequentially, so performance degrades as the rule count grows (O(N))
  • • kube-proxy NAT rules grow in proportion to the number of Services and endpoints

eBPF mode

  • • Hash-based BPF map lookup gives O(1) matching regardless of scale
  • • One BPF program at the TC hook handles policy, NAT, and routing in a single pass, keeping latency low
  • • Socket-level LB picks the backend at connect() time, before any packet exists, so Services work without kube-proxy and DSR is supported

Performance comparison

  • • Latency: iptables higher / eBPF lower
  • • CPU usage: iptables higher / eBPF lower
  • • Rule scalability: iptables limited / eBPF excellent