The extended Berkeley Packet Filter (eBPF) is an infrastructure that allows to dynamically load and run micro-programs directly in the Linux kernel without recompiling it.

In this work, we study how to develop high-performance network measurements in eBPF. We take sketches as case-study, given their ability to support a wide-range of tasks while providing low-memory footprint and accuracy guarantees. We implemented NitroSketch, the state-of-the-art sketch for user-space networking and show that best practices in user-space networking cannot be directly applied to eBPF, because of its different performance characteristics. By applying our lesson learned we improve its performance by 40% compared to a naive implementation.

扩展的 Berkeley 数据包过滤器 (eBPF) 是一种基础架构，它允许直接在 Linux 内核中动态加载和运行微程序，而无需重新编译。

在这项工作中，我们研究了如何在 eBPF 中开发高性能网络测量。我们将草图作为案例研究，因为它们能够支持广泛的任务，同时提供低内存占用和准确性保证。我们实现了 NitroSketch，这是用于用户空间网络的最先进的草图，并表明用户空间网络中的最佳实践不能直接应用于 eBPF，因为它具有不同的性能特征。通过吸取我们的经验教训，与简单的实施相比，我们将其性能提高了 40%。