Proxy ARP at XDP: Answering and Dropping ARP Before skb Allocation

Abstract

Proxy ARP is usually implemented after the network stack has already paid for the packet: whether the logic lives in a kernel module or a userspace daemon, every ARP request has been received into an skb before anyone decides to answer, forward or discard it. An eBPF program attached at the XDP hook runs on the driver's receive buffer before any skb exists. Using BPF hash maps as binding tables and as sets, it can answer known requests in place with XDP_TX, drop unwanted ones with XDP_DROP, and pass only the remainder to the stack. This paper describes that design vendor-neutrally: the conventional implementations and their per-packet cost, the XDP datapath, the drop policy built from sets and maps, operational failure modes, and how to evaluate the result. It also states the main limit plainly: the skb saving requires native (driver-mode) XDP.