Appendix B - Networking & Kernel Notation
Every number and unit used in the book, defined once, with the reasoning behind each one. These are the figures you will quote when someone asks “how fast is this really?” - and the units that keep you honest when you answer.
Rates, sizes and units
| Symbol | Meaning | Notes |
|---|---|---|
1 Gb/s | 10^9 bits per second | Ethernet line rates are decimal |
pps | packets per second | the honest measure for network software |
Mpps / Gpps | 10^6 / 10^9 packets per second | XDP territory starts around 1 Mpps/core |
B / b | byte / bit | Mb is a million bits; MB is a million bytes |
KiB / MiB | 2^10 / 2^20 bytes | memory and map sizes are binary |
64 B | typical minimum Ethernet frame payload | +14 B header, 4 B CRC, 20 B inter-frame gap |
14 B | Ethernet header (ethhdr) | dst MAC 6 B, src MAC 6 B, ethertype 2 B |
20 B | IPv4 header without options (iphdr) | |
20 B | TCP header without options (tcphdr) | data_offset says how many 4-byte words |
8 B | UDP header (udphdr) |
The per-packet budget
The single most useful number in the book. For a machine with C cores
running at F GHz, the time available per packet at R Mpps is:
cycle budget per packet = (C * F * 10^9) / (R * 10^6) cycles/packet
Examples at 4 GHz total (e.g. a 4-core slice):
| Rate | Cycles per packet | What fits |
|---|---|---|
| 1 Mpps | 4000 | full XDP parse + map lookup + redirect |
| 5 Mpps | 800 | tc filter with one map lookup |
| 25 Mpps | 160 | minimal XDP drop (DDoS filter) |
Latency ladder (typical Linux numbers)
| Operation | Order of magnitude | Notes |
|---|---|---|
| L1 / L2 / L3 cache | ~1 / ~4 / ~12 ns | map lookups live here |
bpf() syscall | ~1-3 us | loading is a control-plane op, not data-plane |
epoll_wait wake + copy | ~2-10 us | the socket receive path (Chapter 7) |
| softirq → stack → socket | ~5-15 us | kernel default path with copies |
| XDP drop / redirect | ~0.1-1 us | before the stack, no skb allocation |
sockmap redirect | ~0.5-3 us | in-kernel socket-to-socket, no userspace |
Kernel machinery you will see in logs
| Term | Meaning |
|---|---|
NAPI | the kernel’s polled receive path; disables per-packet IRQs |
GRO / GSO | Generic Receive/Segmentation Offload: merge/split packets |
RSS / RPS | NIC-side / software receive-side scaling across queues |
softirq | deferred interrupt processing; where the stack runs |
skb | struct sk_buff, the kernel’s packet buffer |
qdisc | queueing discipline: tc’s attach point for egress |
clsact | the modern tc attach class for egress and ingress |
conntrack | connection tracking, the nf_conntrack table |
CT (Cilium) | Cilium’s own conntrack in BPF maps |
BPF ring buffer | lock-free BPF_MAP_TYPE_RINGBUF, the modern event path |
Time notation
ktime_get_ns- kernel monotonic clock in nanoseconds; the clock BPF programs use (Chapter 13).CLOCK_MONOTONIC- the userspace twin; immune to wall-clock jumps.- p50 / p99 / p999 - percentile latency; network systems are judged on p99+ because tail latency is what users feel.
Use this appendix as your cheat sheet while reading; every claim in the book is stated so it can be checked against one of these rows.