--- title: "Calico Enterprise: Leverage multiple benefits from the new eBPF data plane" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-enterprise-leverage-multiple-benefits-from-the-new-ebpf-data-plane/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Calico Enterprise: Leverage multiple benefits from the new eBPF data plane By [John Armstrong](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-armstrong/) on Jul 06, 2021 • 3 min read Calico was designed from the ground up with a pluggable data plane architecture. The Enterprise 3.6 release introduces an exciting new [eBPF](https://wordpress-1075849-4005834.cloudwaysapps.com/learn/guides/ebpf/) (extended Berkeley Packet Filter) data plane that provides multiple benefits to users. ## Great performance, lower latency for load-balanced traffic When compared with the standard Linux data plane (based on iptables), the[eBPF data plane](https://wordpress-1075849-4005834.cloudwaysapps.com/features/ebpf-data-plane/): - Scales to higher throughput, using less CPU per GBit - Natively supports Kubernetes services (without kube-proxy) in a way that: - Reduces latency - Preserves external client source IP addresses - Supports direct server return (DSR) for reduced latency and CPU usage - Uses less CPU than kube-proxy to keep the data plane in sync ![Bar graph showing eBPF throughput exceeds standard Linux networking at MTUs 1440 and 8940](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/ebPF-data-plane-1.png) ![Graph showing eBPF has lower TCP connect time compared to iptables and IPVS as the number of services increases](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/ebPF-data-plane-2.png) ## The impact of NAT on source IP The application of network address translation (NAT) by kube-proxy to incoming network connections to Kubernetes services (e.g. via a service node port) is a frequently encountered friction point with Kubernetes networking. NAT has the unfortunate side effect of removing the original client source IP address from incoming traffic. When this occurs, Kubernetes network policies can’t restrict incoming traffic from specific external clients. By the time the traffic reaches the pod it no longer has the original client IP address. For some applications, knowing the source IP address is not only desirable, it’s required. For example, performing geo-location based on source address. ## Calico and direct server return Calico’s eBPF data plane makes several changes to this model. The most significant difference is in swapping out the Kubernetes kube-proxy with native service handling. This eliminates the need for source network address translation (SNAT). Because only destination network address translation (DNAT) is applied, the source IP address is preserved on the request. The response from the pod has a reverse DNAT applied by the eBPF program, at which point the response can be returned directly to the client, a method known as direct server return (DSR). ![Diagram of Kubernetes kube-proxy with SNAT and DNAT, showing how Calico replaces it for native service handling](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/ebPF-data-plane-3.png)Calico without eBPF and DSR   ![Diagram of eBPF data plane replacing kube-proxy for load balancing and encapsulation of external NodePort requests to pods](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/ebPF-data-plane-4.jpeg)Using Calico’s eBPF data plane as a replacement for kube-proxy, the source IP of external connections is preserved. This makes it much easier to write security policy and makes access logs more meaningful. ## Support for host protection Calico has extended its eBPF data plane to offer support for host protection. When combined with Calico’s automatic host endpoints feature, this offers a robust way to secure Kubernetes pods and hosts together using a unified policy model. By deploying Calico for host protection as well as for pod security, your host protection policy becomes just as dynamic as your workload policy, and matches the identity of the workload (carried in its metadata labels). With this new addition, Calico now includes three data planes: - Standard Linux - Windows HNS - eBPF The standard Linux data plane will continue to be the right choice for many. But when you’re ready to adopt the latest Linux kernels, the eBPF data plane will be ready for you. And stay tuned for yet another data plane option that will soon be available for Calico. For more details on the eBPF data plane, check out our [Calico Enterprise eBPF data plane documentation](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/use-cases-ebpf). Included is a detailed comparison of eBPF versus the standard Linux data plane, as well as an architectural overview.   **Want to know more? [Talk to an expert](https://wordpress-1075849-4005834.cloudwaysapps.com/contact/) to have your questions answered, or [request a demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/) to see Calico Enterprise in action.**   [eBPF](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/ebpf/)[Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![Key Insights from the 2025 GigaOm Radar for Container Networking](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Blog-Key-Insights-from-the-2025-GigaOm-Radar-Report-for-Tigera.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/key-insights-from-the-2025-gigaom-radar-for-container-networking/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [Key Insights from the 2025 GigaOm Radar for Container Networking](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/key-insights-from-the-2025-gigaom-radar-for-container-networking/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Jan 8, 2026 Why Calico was named as a Leader in the GigaOm Radar Report for Container Networking In 2025, as modern applications became ever more distributed and the use of Kubernetes continued to proliferate, the role of... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/key-insights-from-the-2025-gigaom-radar-for-container-networking/) [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/)