Port-Range Rule Management and Matching-Path Measurement for eBPF-Based Network Functions

Abstract eBPF is increasingly used to implement programmable network functions on Linux hosts, including boundary filtering, transparent proxying, and firewall-like access control. For network and systems management, such functions require not only correct policy installation but also predictable rule-processing behavior in the data path. This paper studies ZFW, an open-source eBPF-based network function, and identifies an insertion-order-sensitive port-range matching path. In the original implementation, port-range entries are kept in insertion order, so hot-port traffic may traverse many unrelated ranges before reaching the matching rule, while selected miss traffic cannot terminate early even when later ranges are impossible to match. We propose a lightweight management-plane optimization that combines ordered rule insertion and data-plane early termination. The user-space rule maintenance path keeps port-range indexes in ascending order of low_port, while the TC-BPF hot path stops scanning once the destination port is smaller than the current low_port. We further add scan-step instrumentation and reset/read interfaces to support measurement-driven operation and ablation analysis. Experiments covering hit position, rule scale, public-cloud access, local netns/veth environments, mixed workloads, and ablation variants show that the method reduces average scan steps from 100.00 to 1.00 in the core N = 100 scenario. Controlled local tests reduce average latency from 8.10 ms to 6.63 ms and from 3.98 ms to 2.63 ms under lower concurrency. The results show that lightweight rule organization can improve the predictability of eBPF network-function management, while end-to-end latency remains affected by external system and network noise.