--- title: "A Look at the New Calico eBPF data plane" source: "https://www.tigera.io/blog/a-look-at-the-new-calico-ebpf-dataplane/" description: "The Calico 3.13 release introduced an exciting new eBPF (extended Berkeley Packet Filter) dataplane that pushes the Linux kernel’s latest networking capabilities to the limit." --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # A Look at the New Calico eBPF data plane By [John Armstrong](https://www.tigera.io/blog/author/john-armstrong/) on Jul 15, 2020 • 3 min read [Calico](https://www.tigera.io/) was designed from the ground up with a pluggable data plane architecture. The Calico 3.13 release introduced an exciting new eBPF (extended [Berkeley Packet Filter)](http://en.wikipedia.org/wiki/Berkeley_Packet_Filter) data plane targeted at those ready to adopt newer kernel versions and wanting to push the Linux kernel’s latest networking capabilities to the limit. In addition to improved throughput and latency performance compared to the standard Linux networking data plane, Calico’s eBPF data plane also includes native support for Kubernetes services without the need to run kube-proxy. One of the ways Calico’s eBPF data plane realizes these improvements is through source IP preservation and Direct Server Return (DSR) **Kube-proxy and Source IP** The application of Network Address Translation (NAT) by kube-proxy to incoming network connections to Kubernetes services (e.g. via a service node port) is a frequently encountered friction point with Kubernetes networking. NAT has the unfortunate side effect of removing the original client source IP address from incoming traffic. When this occurs, Kubernetes network policies can’t restrict incoming traffic from specific external clients. By the time the traffic reaches the pod it no longer has the original client IP address. For some applications, knowing the source IP address is desirable or required. For example, performing geo-location based on source address. **Calico and Direct Server Return** Calico’s eBPF data plane makes several changes to this model. The most significant difference is in swapping out the Kubernetes kube-proxy with native service handling. This eliminates the need for SNAT. Because only DNAT is applied, the source IP address is preserved on the request. The response from the pod has a reverse DNAT applied by the eBPF program, at which point the response can be returned directly to the client, a method known as Direct Server Return. Calico is keeping the standard Linux data plane, and that will continue to be the right choice for many. But when you’re ready to adopt the latest Linux kernels, Calico’s eBPF data plane will be ready for you. **For further exploration…** It’s relatively easy to try both of these configurations out and directly compare the differences between the two modes of operation. Would you like to explore some of these differences with a simple installation you can try out in your own cloud or virtual environment? [Check out this blog](https://www.tigera.io/blog/hands-on-with-calicos-ebpf-service-handling/), which provides a more detailed description of DSR, as well as instructions on how to demonstrate the differences between the eBPF and standard kube-proxy models. ————————————————- [Free Online Training](/events/) Access Live and On-Demand Kubernetes Training [Calico Enterprise – Free Trial](https://www.calicocloud.io/) Network Security, Monitoring, and Troubleshooting For Microservices Running on Kubernetes [eBPF](https://www.tigera.io/tags/ebpf/)[Open Source](https://www.tigera.io/tags/open-source/)[Project Calico](https://www.tigera.io/tags/project-calico/) ## Related posts [![What’s new in Calico: Spring 2026 Release](https://www.tigera.io/app/uploads/2026/06/Whats-New-in-Calico-NEW-TEMPLATE-2026.png)](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [What’s new in Calico: Spring 2026 Release](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on Jun 2, 2026 Kubernetes has come a long way since its debut in 2014. It’s gone from running a couple of containerized microservices to orchestrating fleets of production workloads spanning everything from AI agents to full scale VMs... [Read more](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [![Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/app/uploads/2026/05/Kubernetes-Operational-Maturity-Secure-and-Resilient-Cluster-Federation-with-Cluster-Mesh.png)](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) #### [Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on May 25, 2026 Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled... [Read more](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) [![What’s New in Calico v3.32](https://www.tigera.io/app/uploads/2026/05/Green-Please-use-a-different-background-color-alternately-1.png)](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) #### [What’s New in Calico v3.32](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on May 13, 2026 We’re excited to announce the release of Calico Open Source v3.32! 🎉 This release corresponds with Kubernetes v1.36 (Codename Haru) and it goes beyond just sharing a cat as the mascot of the release, it... [Read more](https://www.tigera.io/blog/whats-new-in-calico-v3-32/)