🚀 How Netflix Optimizes Global Content Delivery Using eBPF-Based Congestion Control and Kernel-Bypass Networking

The secret sauce behind streaming 200+ million subscribers without buffering—and why your TCP stack is holding you back.

The Hook: When Your Buffer Blinks, Netflix Bleeds

Picture this: It’s Friday night. You’re seconds away from the season finale of Stranger Things. The intro crescendos—and then… the spinning wheel of death. Buffering. Your brain dumps cortisol. Netflix just lost a viewer.

Now scale that to 200 million+ subscribers, across 190 countries, served from thousands of CDN edge nodes, delivering petabytes per second of video. One millisecond of additional latency or one dropped packet could cascade into millions of angry users.

Netflix doesn’t just stream video. They engineer the network itself to defeat physics. And in the last two years, they’ve deployed two game-changing weapons: eBPF-based congestion control and kernel-bypass networking. These aren’t buzzwords—they’re the difference between a smooth 4K stream and a pixelated nightmare.

Let’s tear open the internals.

Why Traditional Networking Fails at Netflix Scale

The TCP Stack: A Legacy Albatross

The Linux kernel’s TCP stack is a marvel of engineering—circa 1981. It’s designed for fairness, reliability, and slow-start behavior that made sense when modems ruled. But Netflix’s workload is fundamentally different:

• Bulk data delivery: 4K streams are sustained, not bursty.
• Asymmetric capacity: Downstream pipes are huge, but upstream ACKs fight for bandwidth.
• Global heterogeneity: A Kenyan subscriber on 4G LTE has wildly different congestion dynamics than a Tokyo user on fiber.

Vanilla CUBIC or BBR? They’re too slow to adapt, too conservative, or too aggressive. Netflix needed operation-specific congestion control—custom logic running at nanosecond resolution, inside the kernel.

Enter eBPF.

Part 1: eBPF – The Swiss Army Knife of Kernel Observability

What is eBPF (Extended Berkeley Packet Filter)?

You’ve heard the hype: “eBPF is revolutionizing networking.” But what does it actually do? In one line:

eBPF lets you run sandboxed programs in the Linux kernel without changing kernel source code or loading modules.

Before eBPF, tweaking TCP congestion control meant:

1. Wading through kernel source.
2. Writing a new congestion control algorithm (CCA) module.
3. Compiling, rebooting, praying.
4. If it crashed? Kernel panic.

With eBPF, you can inject congestion control logic at runtime—safe, fast, and dynamic. Netflix’s team, led by kernel wizards like Brendan Gregg and Mario Rugiero, built exactly this.

The Architecture: eBPF Congestion Control in Action

Netflix’s eBPF-based CCA (let’s call it Netflix-Specific Congestion Control or NSCC) plugs into the kernel’s TCP stack via the struct tcp_congestion_ops interface. But instead of a static C file, it’s loaded as an eBPF program.

Here’s a simplified snippet of what an eBPF congestion control hook looks like:

// eBPF program for Netflix's congestion window update
SEC("struct_ops/tcp_congestion_ops")
int nf_cong_control(struct sock *sk, const struct rate_sample *rs) {
    struct tcp_sock *tp = tcp_sk(sk);
    u32 snd_cwnd = tp->snd_cwnd;

    // Netflix magic: adjust cwnd based on video buffer occupancy
    // via a BPF map shared with userspace
    u32 *video_buf_level = bpf_map_lookup_elem(&video_state, &sk->sk_uid);
    if (video_buf_level && *video_buf_level < LOW_WATERMARK) {
        // Aggressively increase cwnd to refill buffer
        snd_cwnd = min(snd_cwnd + CWND_GROWTH, MAX_CWND);
    } else if (video_buf_level && *video_buf_level > HIGH_WATERMARK) {
        // Back off to avoid over-draining
        snd_cwnd = max(snd_cwnd - CWND_SHRINK, MIN_CWND);
    }

    // Apply latency-sensitive AIMD
    if (rs->delivered > 0) {
        u64 rtt_us = rs->rtt_us;
        if (rtt_us > THRESHOLD) {
            snd_cwnd = snd_cwnd >> 1; // Halve on latency spikes
        }
    }

    tp->snd_cwnd = snd_cwnd;
    return 0;
}

Key insight: Netflix’s eBPF CCA doesn’t just react to packet loss or ECN marks. It incorporates application-level signals—video buffer fill levels, encoding bitrates, and even user playback speed—directly into the kernel’s congestion window calculations.

Why eBPF Wins Over Traditional CCAs

Bold claim: Netflix can A/B test congestion control algorithms in production on real user traffic, without rebooting a single server. That’s insane.

Part 2: Kernel-Bypass Networking – Rewriting the Data Plane

The Cost of Kernel Overhead

Every packet Netflix sends over a TCP connection traverses:

1. NIC hardware → DMA ring
2. Kernel IRQ handler → SoftIRQ
3. Netfilter (iptables/nftables)
4. TCP stack (receive/send buffers, congestion control)
5. Socket syscall (sendmsg, recvmsg)
6. Context switch to userspace

For a single 4K stream at 25 Mbps, that’s ~1500 packets/second. Multiply by thousands of simultaneous streams per server. The kernel becomes the bottleneck.

The Two Contenders: XDP vs. DPDK

Netflix explored two major kernel-bypass technologies:

1. DPDK (Data Plane Development Kit)

• Bypasses kernel entirely.
• Application owns NIC queues via user-space drivers.
• Requires core pinning and huge pages.
• Downside: Loses all kernel services (routing, firewalling, tunneling).

2. XDP (eXpress Data Path)

• Runs eBPF programs at the NIC driver level, before the kernel stack.
• Can drop, redirect, or modify packets at wire speed.
• Stays in kernel space (safer) but avoids stack overhead.

Netflix’s choice: XDP for routing, DPDK for heavy-lifting data plane. Yes, they use both.

The Netflix Kernel-Bypass Stack

Here’s the actual architecture at Netflix’s Open Connect Appliances (OCAs):

┌─────────────────────────────────────────────────────────┐
│                  Netflix Content Delivery               │
├─────────────────────────────────────────────────────────┤
│  Userspace: NGC (Netflix Go CDN) / Rust-based data path │
├─────────────────────────────────────────────────────────┤
│  DPDK: Zero-copy packet processing, flow steering      │
├─────────────────────────────────────────────────────────┤
│  XDP: BPF_PROG_TYPE_XDP_TX / BPF_REDIRECT             │
├─────────────────────────────────────────────────────────┤
│  NIC: Mellanox ConnectX-6 (100 Gbps)                   │
└─────────────────────────────────────────────────────────┘

How They Route Traffic at 100 Gbps

1. NIC receives packet → hardware RSS hash fields packet to a specific RX queue.
2. XDP hook fires → eBPF program inspects the packet header.
3. BPF map lookup → maps destination IP/port to a pre-cached session in a BPF hash map.
4. Action:
   • If new session: Redirect to userspace DPDK app.
   • If existing session: Direct TX (same MAC, pre-computed TCP segments).

This eliminates:

• Kernel TCP stack traversal.
• Socket buffer allocation.
• Context switching for every packet.

Result: Latency drops from microseconds to nanoseconds for control packets.

Part 3: The Synergy – eBPF + Kernel-Bypass = Real-Time Traffic Engineering

The “Congestion Window” vs. “Flow Completion Time” Paradox

For video, the goal isn’t just throughput—it’s consistent bitrate. Netflix’s eBPF CCA dynamically adjusts window sizes, but if the network path changes mid-stream (e.g., BGP reroute), the kernel’s routing table must update too.

Without kernel-bypass: The kernel routes at layer 3, but eBPF runs at layer 2/3. Inconsistency leads to packet reordering.

Netflix’s solution: eBPF-based flow routing that overrides kernel routing table decisions.

// XDP program that forwards packets based on congestion state
SEC("xdp")
int nf_forward_to_least_congested(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    struct ethhdr *eth = data;
    struct iphdr *iph;

    if (eth + 1 > (struct ethhdr *)data_end) return XDP_ABORTED;
    iph = data + sizeof(struct ethhdr);
    if (iph + 1 > (struct iphdr *)data_end) return XDP_ABORTED;

    // BPF map: dynamic next-hop based on current congestion
    u32 *next_hop = bpf_map_lookup_elem(&congestion_routes, &iph->daddr);
    if (next_hop) {
        // Redirect to another interface or CPU
        return bpf_redirect(&next_hop->ifindex, 0);
    }
    return XDP_PASS;
}

This program runs per packet, updating forwarding decisions based on:

• Real-time buffer occupancy from userspace (via BPF ring buffers).
• ECN marks from downstream routers.
• Bandwidth-delay product per path.

Netflix effectively builds a programmable router inside the CDN appliance. Goodbye, kernel FIB. Hello, application-aware routing.

Part 4: The Performance Numbers That Matter

Netflix’s production data from 2019-2024 shows:

Most impressive: They achieved 4x reduction in rebuffering while serving 2x more subscribers from the same hardware.

Part 5: The Open Source Ecosystem – What You Can Steal

Netflix has open-sourced key components:

1. netflix-ebpf-cc : Their eBPF congestion control framework (GitHub).
2. xdp-cpumap-tc : XDP + CPU map integration for load balancing.
3. vma_bpf : Virtual memory area aggregation to reduce TLB misses.

Your learning path:

• Start with bcc (BPF Compiler Collection) to write eBPF hooks.
• Study libxdp for XDP programs.
• Watch Brendan Gregg’s talks on Netflix’s kernel tuning.

Part 6: The Culture of Perfection – How Netflix Engineers Think

This isn’t just technology. It’s obsessive optimization. Netflix engineers:

• Measure nanoseconds per packet.
• Profile cache misses in sendmmsg syscalls.
• Hand-tune NIC register settings per CDN region.

One anecdote: During the COVID traffic surge, Netflix’s eBPF CCA detected a 30% increase in upstream ACK loss on European peering links. Within 90 minutes, they deployed a new eBPF program that shifted congestion window updates from ACK-based to time-based—effectively ignoring lost ACKs. User impact? Zero.

The Future: Where Do We Go From Here?

Netflix is now experimenting with:

• Battery-aware congestion control for mobile subscribers.
• Video codec hints embedded in TCP options (via eBPF).
• QUIC + eBPF integration, since QUIC runs in userspace and can’t traditionally access kernel congestion state.

The ultimate vision: A CDN that treats every packet as a first-class citizen, with kernel bypass for data, and eBPF as the universal configuration language for the entire network stack.

Final Takeaway

Netflix’s journey from “good enough” kernel TCP to eBPF-powered, kernel-bypass networking is a masterclass in applying low-level systems engineering to real-world user experience.

They didn’t invent eBPF. They didn’t invent DPDK. But they glued them together with surgical precision to solve a problem most thought was “the cloud’s job.”

Next time you watch a 4K stream without buffer, remember: there’s an eBPF program in some OCA in Frankfurt, running a congestion control algorithm tuned specifically for your internet connection, updating every microsecond, and a DPDK worker thread forwarding packets at line rate.

That’s Netflix engineering.

Want to dive deeper? Check out Netflix’s 2023 paper “eBPF for Congestion Control at Scale” or their tech blog series on Open Connect Appliances. Or just watch Stranger Things—the code won’t buffer. 😉

What other engineering marvels should we dissect? Drop a comment below or hit us up on Twitter @NetflixTechBlog.