Company
Date Published
Author
Matt Fleming and Jesper Brouer
Word count
1973
Language
English
Hacker News points
None

Summary

The blog post delves into the performance issues encountered with BPF LPM tries, a critical data structure used for tasks like IP and IP+Port matching in network routing. These tries, integral to Cloudflare's Magic Firewall, have shown bottlenecks when dealing with millions of entries, leading to significant lookup times and CPU lockups, which can result in traffic packet loss. The post provides a refresher on trie data structures, explaining their efficiency in memory usage and search operations due to their prefix matching capabilities. It highlights the limitations of the current BPF LPM trie implementation, such as its two-child node design, which impacts search efficiency and height, and the lack of optimizations like level compression. The article shares benchmark results illustrating the declining performance with increased entries due to cache and dTLB miss rates. It concludes by discussing the need for improvements in the BPF LPM trie implementation, suggesting the adoption of a Level Compressed trie similar to those used in the Linux kernel for more efficient IP routing, with future work aimed at enhancing the lookup function's performance.