--- title: "eBPF Data Plane" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/features/ebpf-data-plane/" --- Solution # eBPF Data Plane Leverage multiple performance benefits from the new eBPF data plane [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ![eBPF Calico Enterprise](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/eBPF-Calico-Enterprise.png) ## Benefits ![Two overlapping blue parallelograms](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/05/Icon-1.png) ### Future-proof Calico provides investment protection by providing a single solution that supports eBPF, along with the standard Linux and Windows data planes. With this approach, Tigera is future-proofing your decision to choose Calico ### Higher Throughput, Lower CPU Scales to higher throughput, using fewer CPU resources per GBit when compared with the standard Linux data plane (based on iptables) ### Preserves Source IP Preserves the source IP address of incoming network connections by swapping out the Kubernetes kube-proxy with native service handling, and eliminating source network address translation (SNAT). For many applications, knowing the source IP address is essential ## Trusted by Customers Worldwide [![Orange logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Siemens Healthineers logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Nowcom logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-NOWCOM.png)](http://www.nowcom.com/) [![Presidio logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![Essentra logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![GoDaddy logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/10/logo-eHealth.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/ehealth-case-study/) [![Coinmetrics logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ## Capabilities ![Throughput (GBit/s) Graph](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/04/throughput.png) ### Higher Throughput vs. Standard Linux Natively supports Kubernetes services (without kube-proxy) in a way that - Reduces latency - Preserves external client source IP addresses - Supports direct server return (DSR) for reduced latency and CPU usage - Uses less CPU than kube-proxy to keep the data plane in sync ![Calico Security Policy](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/calico-security-policy-1.png) ### Support for Host Protection When combined with Calico’s automatic host endpoints feature, the eBPF data plane offers a robust way to secure Kubernetes pods and hosts together using a unified policy model. By deploying Calico for host protection as well as for pod security, your host protection policy becomes just as dynamic as your workload policy, and matches the identity of the workload (carried in its metadata labels). ## How It Works ![eBPF how it works Diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/eBPF-how-it-works01.png) The application of network address translation (NAT) by kube-proxy to incoming network connections to Kubernetes services (e.g. via a service node port) is a frequently encountered friction point with Kubernetes networking. NAT has the unfortunate side effect of removing the original client source IP address from incoming traffic. When this occurs, Kubernetes network policies can’t restrict incoming traffic from specific external clients. By the time the traffic reaches the pod it no longer has the original client IP address. For some applications, knowing the source IP address is not only desirable, it’s required. For example, performing geo-location based on source address. ![eBPF how it works Diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/eBPF-how-it-works02.png) Calico’s eBPF data plane makes several changes to this model. The most significant difference is in swapping out the Kubernetes kube-proxy with native service handling. This eliminates the need for SNAT. Because only destination network address translation (DNAT) is applied, the source IP address is preserved on the request. The response from the pod has a reverse DNAT applied by the eBPF program, at which point the response can be returned directly to the client, a method known as direct server return (DSR). ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Resources ![O’Reilly eBook: Kubernetes Security and Observability](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/Featured-resources-OReilley-ebook.png) eBook ### O’Reilly eBook: Kubernetes Security and Observability Learn to secure Kubernetes workloads and monitor network traffic for compliance and security. [Learn More](https://www.tigera.io/blog/oreilly-ebook-kubernetes-security-and-observability-early-release/) ![Announcing eBPF Mode GA](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2020/04/eBPF-DP.png) Blog ### Announcing eBPF Mode GA We have marked the eBPF dataplane as “GA”, signalling that it is now stable and ready for wider use by the community. [Learn More](https://www.tigera.io/blog/announcing-ebpf-mode-ga/) ![eBPF Use Cases in Calico Enterprise](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/Calico-Enterprise-Tigera-1200x628-1.png) Documentation ### eBPF Use Cases in Calico Enterprise Read the docs to see how the eBPF data plane works in Calico Enterprise, and when to use it. [Learn More](https://docs.tigera.io/calico-enterprise/latest/operations/ebpf/use-cases-ebpf) ![Calico Logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/)