Measuring the cost of the Linux network stack in real-time

As network interfaces in the data center get faster and faster, and an increasingly big portion of the services is implemented in software, we must wonder just how much time our servers' CPUs are spending handling network traffic. This paper explores the feasibility of measuring the cost of the entire in-kernel network stack in real-time on production systems by relying on the eBPF tracing capabilities instead of utilizing custom logic or kernel patching. We describe two methods that have been attempted, respectively based on an "exact" instrumentation of the stack and sampling, along with the advantages and defects of each approach.