ELVIS: eBPF-based extensions of linux hosts for using virtual network functions with service function chaining and in-band network telemetry
Marco Häberle, Benjamin Steinert, Michael A. Weiss, Michael Menth · Computer Networks · 2025
Service function chaining (SFC) is a technology that enables dynamic steering of packets to processing nodes, also called Service Functions (SFs), e.g., firewalls, IDSs, or NAT gateways. An SFC classifier located at the border of SFC-enabled domains encodes information about the order of SFs, the Service Function Chain, into packet headers. This encoded information, called SFC encapsulation, is used by the network to steer packets to the respective SFs. Because most existing SFs do not support SFC encapsulations natively, a proxy is required to make them SFC-compatible. However, simple proxies operate in a stateless manner and are not capable of preserving per-packet metadata. In this paper, we propose a dynamic SFC proxy that is capable of preserving metadata by caching the SFC encapsulation while a packet is processed by a SF. In addition, the proxy implements In-band Network Telemetry (INT) to support monitoring and debugging related to SFs. INT is a network monitoring framework that adds packet-specific metrics to the header stack of a packet. Although INT has been standardized with a focus on network switches and routers, a proxy-based implementation for SFs extends its usability in an SFC scenario. We present concept, use cases, and an eBPF-based implementation of the INT-enabled caching SFC proxy. Finally, we evaluate the performance of a prototype.