Systems Networking

---
name: systems-networking
description: |
  Systems-level networking architecture: kernel-bypass (DPDK, io_uring, eBPF/XDP),
  zero-copy, the network stack data path, NIC offloads, congestion control, and
  high-connection-count (C10M) server design. Architect-level, not app HTTP.

  USE WHEN: designing high-throughput/low-latency networking, packet processing,
  "kernel bypass", "DPDK", "io_uring", "eBPF", "XDP", "zero-copy", "C10M",
  "line rate", NIC offload, congestion control, software data plane.

  DO NOT USE FOR: REST/GraphQL API design (use api-design skills); app websockets
  (use real-time skills); cloud LB config (use infrastructure skills).
allowed-tools: Read, Grep, Glob
---
# Systems Networking Architecture

## The latency/throughput ladder (pick the lowest tier that meets needs)

| Tier | Mechanism | Throughput/latency | Cost/complexity |
|---|---|---|---|
| Sockets + epoll | Classic kernel stack | Good; syscalls + copies dominate | Lowest |
| **io_uring** | Async, batched, shared rings | Fewer syscalls/copies | Moderate; Linux ≥5.x |
| **eBPF/XDP** | Run code at the driver hook | Drop/redirect at line rate before stack | Verifier limits; per-packet logic |
| **Kernel bypass (DPDK)** | Poll-mode driver in userspace | 10–100M pps, µs latency | High; burns cores, no kernel stack |

Decision drivers: required **pps/latency**, CPU budget (DPDK busy-polls cores),
need for the kernel stack (TLS, routing), and operational complexity.

## Architectural levers

- **Zero-copy**: avoid user/kernel copies (sendfile, splice, io_uring fixed
  buffers, DPDK mbufs). Copies are often the real bottleneck.
- **Per-core / shared-nothing**: thread-per-core with RSS/affinity (Seastar
  model) to kill cross-core contention and cache bouncing.
- **NIC offloads**: checksum, TSO/LRO, RSS, and increasingly full TCP/crypto
  offload; SmartNIC/DPU pushes the data plane off the host CPU.
- **Congestion control**: choose per goal — CUBIC (throughput), BBR
  (latency/bufferbloat), DCTCP (datacenter). Matters for tail latency.
- **C10M**: the bottleneck is per-connection kernel cost and copies → bypass +
  zero-copy + per-core state.

## When to recommend what
- API server, normal scale → sockets/epoll or io_uring; don't over-engineer.
- Software router/firewall/LB at line rate → XDP/eBPF or DPDK.
- µs-tail trading/telco data plane → DPDK + per-core + kernel-bypass, SmartNIC.