Design and Implementation of eBPF-based Virtual TAP for Inter-VM Traffic Monitoring

With the proliferation of cloud computing and services, the internet traffic and the demand for better quality of service are increasing. To handle a huge amount of traffic using limited resources in a data center, server virtualization technology, which uses the resources of internal servers in the data center more efficiently, is receiving increased attention. However, the existing hardware test access port (TAP) equipment that duplicates packets for monitoring has many drawbacks, which make it unfit for deployment in the virtual datapaths configured for server virtualization. vTAP, which is a software version of the hardware TAP, overcomes this problem by duplicating packets in a virtual switch. However, implementation of vTAP in a virtual switch has a performance problem because it uses the computing resources of the host machines. To overcome this problem, we propose a vTAP implementation technique based on the extended Berkeley packet filter (eBPF), which is a high-speed packet processing technology. Finally, we compare its performance with that of the existing virtual TAP.