--- title: "Key advantages of the Calico eBPF data plane" source: "https://www.tigera.io/blog/key-advantages-of-the-calico-ebpf-data-plane/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Key advantages of the Calico eBPF data plane By [Chris Tomkins](https://www.tigera.io/blog/author/chris-tomkins/) on Jun 09, 2022 • 5 min read ## Project Calico and eBPF Project Calico has offered a production-ready [data plane](https://www.tigera.io/blog/the-importance-of-calicos-pluggable-data-plane/) based on eBPF [since September 2020](https://www.tigera.io/blog/announcing-ebpf-mode-ga/), and it’s been available for technical evaluation for even longer (since February 2020). ![Project Calico logo: An orange cat with a ball of yarn, representing its eBPF data plane](https://www.tigera.io/app/uploads/2022/06/image3-1.png)![Project Calico logo; eBPF-based data plane available since Feb 2020 (production-ready Sept 2020](https://www.tigera.io/app/uploads/2022/06/image1-1.png) The [pre-requisites and limitations](https://docs.tigera.io/calico/latest/operations/ebpf/enabling-ebpf) are simple to review, it’s [easy to enable](https://docs.tigera.io/calico/latest/operations/ebpf/enabling-ebpf#how-to), and it’s [easy to validate your configuration](https://www.tigera.io/blog/a-visual-guide-to-calico-ebpf-data-plane-validation/). So, there’s never been a better time to start experiencing the benefits! ***You do know what those are, don’t you? Don’t worry if not! That’s what this blog post is about. We’ve reached a point where the journey is easy to make, if you know why you want to get there.*** ## Key advantages of using Calico with eBPF Calico is already the most widely deployed Kubernetes network security solution. What can [eBPF](https://www.tigera.io/learn/guides/ebpf/) do to help our winning formula further? I’ll dive into the details, but let’s look at the highest possible level first. These three key benefits apply across all supported environments: - General performance - Native Kubernetes service handling - Source IP preservation and Direct Server Return, or DSR - Each of these benefits is significant and worth discussing in more detail. ## Performance Calico’s eBPF data plane achieves high performance in several ways. Firstly, it achieves higher throughput and/or less CPU per Gigabit of throughput. These two are essentially opposite sides of the same coin. This first benefit is achieved because [eBPF programs](https://ebpf.io/) run in kernel space and they run early in the netfilter packet flow, which results in increased efficiency. Some graphs are included below to illustrate the gains, but frankly, I encourage you to test on a cluster closely resembling your own setup—the improvement can be significant and it’s great to see it yourself! As you can see, normalizing the CPU usage per Gigabit, the eBPF data plane uses significantly less CPU per Gigabit than the standard Linux networking data plane. The margin is the biggest with small packet sizes. For throughput tests, we used qperf to measure throughput between a pair of pods running on different nodes. Since much of the networking overhead is per packet, we tested with both 1440 byte MTU and 8940 byte MTU. The results speak for themselves. However, it’s important not to misinterpret this data as the throughput limit for the node, rather than for a single instance of qperf. With either data plane, you could saturate the 40 Gigabit link if you assigned more CPU for a multi-threaded application or ran more pod instances. ![Bar chart comparing CPU usage of standard Linux networking and eBPF for 1440 and 8940 byte MTUs in qperf throughput tests](https://www.tigera.io/app/uploads/2022/06/image7.png) ![Bar chart comparing eBPF and standard Linux networking throughput at different MTUs](https://www.tigera.io/app/uploads/2022/06/image5.png) ## Native Kubernetes service handling As a general philosophy, maintaining compatibility with upstream Kubernetes components when possible is usually beneficial to the community. Originally, Calico’s eBPF data plane wasn’t planned to replace kube-proxy. However, as development progressed, we found that the optimum eBPF design for Calico’s features wouldn’t be able to work with the existing kube-proxy without introducing significant complexity and reducing overall performance. Once we were nudged towards replacing kube-proxy, we decided to see how we could improve on the upstream implementation by natively handling Kubernetes services within the Calico data plane. - Replacing kube-proxy results in: - Reduced complexity Latency reduction (most noticeable with many short-lived, latency-sensitive connections) Implementation of service handling in kube-proxy uses a list of rules that grows with the number of services. Hence, its latency gets worse as the number of services increases. Both kube-proxy’s IPVS mode and Calico’s eBPF implementation use an efficient map lookup instead, resulting in a flat performance curve as the number of services increases. ## ![Graph showing increased TCP connection time with iptables as the number of services increases; IPVS and eBPF remain](https://www.tigera.io/app/uploads/2022/06/image2-1.png) ## Source IP preservation and Direct Server Return The data path through a cluster with the eBPF data plane enabled is simplified. This is best understood by contrasting visualizations of the flows before and after enabling the eBPF data plane. Without Calico’s eBPF data plane: ![Diagram showing complex Kubernetes network traffic routing without Calico's eBPF data plane, relying on iptables and](https://www.tigera.io/app/uploads/2022/06/image6.png) With Calico’s eBPF data plane: ![Diagram showing Calico's eBPF data plane directing network traffic between client and service pod via Kubernetes nodes](https://www.tigera.io/app/uploads/2022/06/image4.png) Did you spot the two improvements that the eBPF data plane enables? - **Source IP preservation** – The service pod can see the real IP of the user and can act on it or record it appropriately. This is a big benefit because there are many security, compliance and SLA-related reasons why you might want to log or see the real IP of the client on the workload pods. - **Direct server return (DSR)** – If the upstream network allows it, the return traffic can go straight out to the user, reducing unnecessary cluster load and reducing undesirable latency. ## Ready to try Calico eBPF? If you feel ready to jump in, the road is clear and there’s no time like the present! Get started with [our documentation](https://docs.tigera.io/calico/latest/operations/ebpf/enabling-ebpf). Or, if Calico is working just fine for you and you want to know more before diving into eBPF, tigera offers a series of free Calico courses: - [CCO-L2-EBPF](https://academy.tigera.io/course/certified-calico-operator-ebpf/) – which is specifically about the eBPF data plane. - [CCO-L1](https://academy.tigera.io/course/certified-calico-operator-level-1/)– about container and Kubernetes networking and security fundamentals. *The eBPF logo by the eBPF Foundation is licensed under CC-BY-4.0* [eBPF](https://www.tigera.io/tags/ebpf/)[Open Source](https://www.tigera.io/tags/open-source/)[Project Calico](https://www.tigera.io/tags/project-calico/) ## Related posts [![What’s new in Calico: Spring 2026 Release](https://www.tigera.io/app/uploads/2026/06/Whats-New-in-Calico-NEW-TEMPLATE-2026.png)](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [What’s new in Calico: Spring 2026 Release](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on Jun 2, 2026 Kubernetes has come a long way since its debut in 2014. It’s gone from running a couple of containerized microservices to orchestrating fleets of production workloads spanning everything from AI agents to full scale VMs... [Read more](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [![Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/app/uploads/2026/05/Kubernetes-Operational-Maturity-Secure-and-Resilient-Cluster-Federation-with-Cluster-Mesh.png)](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) #### [Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on May 25, 2026 Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled... [Read more](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) [![What’s New in Calico v3.32](https://www.tigera.io/app/uploads/2026/05/Green-Please-use-a-different-background-color-alternately-1.png)](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) #### [What’s New in Calico v3.32](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on May 13, 2026 We’re excited to announce the release of Calico Open Source v3.32! 🎉 This release corresponds with Kubernetes v1.36 (Codename Haru) and it goes beyond just sharing a cat as the mascot of the release, it... [Read more](https://www.tigera.io/blog/whats-new-in-calico-v3-32/)