DPDK Summit 2025

In virtualized environments, a hypervisor-based switch provides the network fabric, often fully accelerated by NIC hardware. A common approach to extending its functionality is service chaining, where packets traveling to or from a VM/container pass through additional processing stages such as firewalling, encryption, routing, and more.

However, even with hardware acceleration, multiple packet transitions (e.g., Wire-to-FW, FW-to-Switch, Switch-to-VM) introduce processing overhead and limit performance, making it difficult to fully leverage hardware offload. An alternative—embedding all functionality within the switch—reduces modularity and compartmentalization, forces a single implementation, prevents the use of off-the-shelf products, and complicates architecture and maintenance.

In this talk, we introduce a novel approach using the DPDK Flow API to create a single hardware-accelerated pipeline while maintaining full modularity and separation between security functions and other services. This solution optimizes service chaining for firewalls, encryption and additional network services, maximizing acceleration without sacrificing flexibility or architectural simplicity.