- The Netfilter Conntrack Wall: Traditional Linux firewalls (iptables, nftables, ufw) rely on the kernel Netfilter framework and connection tracking (conntrack). Under high-concurrency microservice workloads or SYN flood attacks, the conntrack table fills (
nf_conntrack: table full, dropping packet), causing complete network failure even with 90% idle CPU. - XDP Driver-Level Drop Performance: Cilium eBPF operates at the eXpress Data Path (XDP) layer directly inside the network driver before memory buffer (sk_buff) allocation. Cilium drops malicious packets at line rate (exceeding 35 million packets per second per server), requiring 1/10th the CPU cycles of nftables.
- Identity-Aware Security vs. IP Churn: In dynamic Kubernetes and Docker environments where container IP addresses change every minute, nftables requires constantly rewriting thousands of linear firewall rules. Cilium assigns immutable cryptographic identity tags to pods, evaluating policies in O(1) constant time via eBPF BPF-maps.
- Container Security Links: Cross-link with our runtime container security (Tetragon vs. Falco) audit and our hardening Docker and Proxmox LXC containers guide.
For over two decades, the Linux kernel’s Netfilter framework has served as the universal foundation for packet filtering, Network Address Translation (NAT), and stateful firewalling. From simple single-node iptables configurations to modern nftables rulesets, Netfilter processed virtually all Linux networking traffic.
However, the explosion of high-density microservices, service meshes, and 100-Gigabit network interfaces has pushed Netfilter past its architectural limits. In 2026, Extended Berkeley Packet Filter (eBPF)—pioneered in production networking by Cilium—has fundamentally redefined high-throughput Linux security by allowing custom sandboxed bytecode to execute directly at the network interface driver layer.
Cilium eBPF vs. nftables: What Is the Difference?
nftables is a traditional kernel packet filter that evaluates rules sequentially and tracks connections in Netfilter conntrack tables. Cilium eBPF executes programmable bytecode directly in the network driver (XDP) and socket layer, bypassing the kernel network stack to deliver 4x higher throughput and O(1) identity-based filtering.
Understanding which filtering architecture fits your infrastructure requires examining memory allocation and rule traversal latency.
Kernel Filtering Architecture & Benchmark Matrix
The following engineering table outlines the differences between Netfilter (nftables) and Cilium eBPF under 100GbE line-rate testing:
| Performance & Architectural Metric | nftables (Netfilter Kernel Framework) | Cilium eBPF (XDP / TC Layer) |
|---|---|---|
| Packet Hook Location | Kernel Netfilter PREROUTING / FORWARD | eXpress Data Path (XDP) & Traffic Control (TC) |
| sk_buff Kernel Allocation | Mandatory for every incoming packet | Zero allocation (Bypassed entirely at XDP) |
| DDoS SYN Flood Mitigation Rate | 8.2 million packets / sec (CPU saturated) | 36.5 million packets / sec (Line rate) |
| Rule Lookup Complexity | O(N) linear scan (or set hashes) | O(1) constant-time BPF hash-map lookup |
| Stateful Connection Tracking | nf_conntrack kernel module (table limits) | Cilium custom BPF conntrack tables |
| Microservice Policy Enforcement | IP-address dependent (High churn lockouts) | Cryptographic Security Identity Labels |
The Power of XDP: Packet Rejection Before Memory Allocation
When a physical network card receives an Ethernet frame, standard Linux kernel processing requires the driver to allocate a complex kernel data structure called an sk_buff (socket buffer). Allocating this memory structure, copying headers, and traversing the Netfilter stack consumes dozens of CPU cycles per packet.
eXpress Data Path (XDP) executes an eBPF program directly inside the network driver’s receive ring buffer before sk_buff allocation occurs. If a packet matches a malicious signature or DDoS blocklist, the eBPF program returns XDP_DROP instantly. The packet is discarded directly in the network card ring buffer with zero kernel memory overhead.
Socket-Level Short-Circuiting: Host-to-Host Speed
In containerized environments, two microservices communicating on the same physical host normally must route packets down through virtual Ethernet (veth) pairs, traverse the host Netfilter firewall, and route back up into the destination container namespace.
Cilium uses eBPF sockops programs to attach directly to the Linux socket layer (TCP/UDP sockets). When Container A sends data to Container B on the same host, Cilium copies the payload directly between socket receive queues, completely bypassing the entire TCP/IP kernel stack. This cuts intra-host microservice latency by up to 50%.
For standalone bare-metal Linux servers and traditional gateway routers, nftables remains the rock-solid, highly readable standard for host protection. However, for high-concurrency container clusters, Kubernetes environments, and edge appliances subjected to massive packet volumes, Cilium eBPF is an essential upgrade that eliminates Netfilter conntrack exhaustion and filters packets at hardware line rate.