--- title: An eBPF Loophole: Using XDP for Egress Traffic | daily.dev description: Loophole Labs discovered a technique to use XDP (eXpress Data Path) for egress traffic by exploiting how Linux handles veth interfaces. XDP traditionally only... canonical: https://daily.dev/posts/an-ebpf-loophole-using-xdp-for-egress-traffic-h5yjyrjs0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: An eBPF Loophole: Using XDP for Egress Traffic | daily.dev og:description: Loophole Labs discovered a technique to use XDP (eXpress Data Path) for egress traffic by exploiting how Linux handles veth interfaces. XDP traditionally only... og:url: https://daily.dev/posts/an-ebpf-loophole-using-xdp-for-egress-traffic-h5yjyrjs0 og:image: https://api.daily.dev/og/posts/H5YjYRjs0.png og:image:alt: An eBPF Loophole: Using XDP for Egress Traffic og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # An eBPF Loophole: Using XDP for Egress Traffic **[Hacker News](https://daily.dev/sources/hn)** · 14 min read · 0 upvotes · 0 comments ## Summary Loophole Labs discovered a technique to use XDP (eXpress Data Path) for egress traffic by exploiting how Linux handles veth interfaces. XDP traditionally only works for ingress traffic, but by routing egress packets through veth pairs, packets arrive at the RX queue of the peer interface and trigger XDP hooks. This approach achieves 194Gbps throughput (9-12x faster than iptables/TC) and works with existing Docker/Kubernetes containers without infrastructure changes. The technique requires manual checksum calculation and ARP resolution since it bypasses the kernel networking stack. The team is building an open-source Docker network plugin and uses this discovery to power their live migration platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cloudflare’s eBPF Replatforming Part 4: Observability, Operations, and Reliability Improvements from eBPF](https://daily.dev/posts/cloudflare-s-ebpf-replatforming-part-4-observability-operations-and-reliability-improvements-from-k5xeelty4) · eBPF · 3 upvotes · 1 comments - [Cloudflare’s eBPF Replatforming Part 2: Filling Gaps in the Linux Ecosystem with eBPF](https://daily.dev/posts/cloudflare-s-ebpf-replatforming-part-2-filling-gaps-in-the-linux-ecosystem-with-ebpf-f9wl5aqgf) · eBPF · 3 upvotes · 0 comments - [Cloudflare’s eBPF Replatforming Part 1: The eBPF Pivot – From Hardware Lock-in to Programmable Networking](https://daily.dev/posts/cloudflare-s-ebpf-replatforming-part-1-the-ebpf-pivot-from-hardware-lock-in-to-programmable-netwo-qcdggfpuw) · eBPF · 0 upvotes · 0 comments - [Inside the Packet: How Kubernetes Networking Actually Works at L3/L4](https://daily.dev/posts/inside-the-packet-how-kubernetes-networking-actually-works-at-l3-l4-mlktkkrux) · Container Journal · 1 upvotes · 0 comments - [What Is eBPF? Use Cases, Benefits, and Key Differences](https://daily.dev/posts/what-is-ebpf-use-cases-benefits-and-key-differences-5dgqadloo) · Isovalent · 3 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#linux](https://daily.dev/tags/linux), [#networking](https://daily.dev/tags/networking) [View this post on daily.dev](https://daily.dev/posts/an-ebpf-loophole-using-xdp-for-egress-traffic-h5yjyrjs0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"An eBPF Loophole: Using XDP for Egress Traffic","url":"https://daily.dev/posts/an-ebpf-loophole-using-xdp-for-egress-traffic-h5yjyrjs0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/an-ebpf-loophole-using-xdp-for-egress-traffic-h5yjyrjs0"},"datePublished":"2025-11-05T15:51:55.150Z","dateModified":"2026-03-15T04:18:08.092Z","description":"Loophole Labs discovered a technique to use XDP (eXpress Data Path) for egress traffic by exploiting how Linux handles veth interfaces. XDP traditionally only...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3429c5c7d0681d124f055fbdc9b0b59b?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3429c5c7d0681d124f055fbdc9b0b59b?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/an-ebpf-loophole-using-xdp-for-egress-traffic-h5yjyrjs0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,linux,networking","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"An eBPF Loophole: Using XDP for Egress Traffic"}]} ```