Sub-Microsecond In-Kernel Packet Containment: Microarchitectural Cache Locality and Zero-Copy AF_XDP in Industrial OT Fabrics

Cyber-Physical Systems (CPS) and Operational Technology (OT) networks controlling electrical substations, water treatment facilities, and petrochemical refineries require deterministic sub-millisecond reaction bounds to prevent catastrophic physical damage. Conventional Network Intrusion Detection Systems (NIDS) and cloud Security Information and Event Management (SIEM) architectures introduce unacceptable detection-to-mitigation delays ranging from 15 to 60 seconds, largely due to operating system socket buffer (sk_buff) allocation overhead, userspace context-switch penalties, and transport-layer egress queuing. To overcome these latency barriers, this paper presents an in-kernel active defense architecture leveraging eBPF/XDP Compile Once – Run Everywhere (CO-RE) filters tightly coupled with an Address Family XDP (AF_XDP) Zero-Copy UMEM descriptor engine. By intercepting frames directly at the Network Interface Card (NIC) driver reception ring, our system achieves deterministic, line-rate active packet dropping before kernel memory allocation. Grounding our evaluation in the recently established 14-dimensional Sentinel-Bench empirical standard, we conduct extensive microarchitectural evaluations on bare-metal 10 GbE hardware under 10.25 M packets per second (EPS) line-rate saturation. Our system achieves a median in-kernel drop SLA of 0.84 µs (840 ns), maintains an Instructions Per Cycle (IPC) efficiency of 2.42 with a Last-Level Cache (LLC) miss rate of only 1.24%, and establishes an Extreme Value Theory (EVT) p99.999% Worst-Case Execution Time (WCET) upper bound of 1.82 µs. We demonstrate that in-kernel line-rate containment comfortably satisfies the physical plant Critical Clearing Time (T_crit <= 38.4 ms), successfully preventing physical state destabilization under Industroyer2 and SCADA TRITON adversarial injection.