CAPABILITIES
What it provides
- XDP filtering at the network interface and supported TC attachment points.
- Address, protocol, and port policies for the services on a host.
- Supported source-rate controls and kernel-map enforcement.
- Central configuration with host-level network and enforcement events.
DEPLOYMENT WORKFLOW
How to use it
- 01
Deploy a Linux host agent with the required privileges, kernel support, and BTF.
- 02
Connect it to the project using a provisioned client certificate and review program attachment status.
- 03
Configure firewall policies for the intended interfaces and validate connectivity before broad enforcement.
CONFIGURATION & OPERATION
Where it fits in your setup
Use the project Firewall and Hosts pages to inspect agent state and configure supported network controls. Native XDP attachment depends on the network driver; actual performance depends on mode, hardware, and policy.
COVERAGE & LIMITS
What to account for
eBPF is Linux-specific and requires compatible kernel capabilities. Packet filtering cannot interpret every application behavior or replace L7 inspection. Carefully scope network policies to avoid disrupting administrative or application traffic.