VPP — Vector Packet Processing Framework

Last reviewed: 2026-05-29

Vector Packet Processing (VPP) is a high-performance, open-source packet processing framework developed by the FD.io project (Fast Data — Input/Output) under the Linux Foundation. VPP is designed to process packets in vectors (batches) rather than one at a time, achieving dramatically higher throughput compared to traditional kernel-based networking.

Overview

VPP is the data-plane technology behind Cisco's VPP-based products (formerly Cisco's Vector Packet Processing technology, open-sourced in 2016). It's used in telecom, data centers, and edge networking for:

Software routers and switches
Network function virtualization (NFV)
Carrier-grade NAT (CGNAT)
IPsec/VPN gateways
Load balancing
Security appliances (firewalls, DPI)

Training Content

607e724f8dfb1a2d5928bbc0_renew-nexus-project-report.pdf (6.6 MB) — Project report on VPP implementation in the "Renew Nexus" project context. Covers VPP architecture, integration with existing network infrastructure, performance benchmarking, and deployment considerations.

Key Concepts

Vector Processing

Traditional packet processing (kernel, iptables, raw sockets) processes one packet at a time — this causes poor cache locality and high branch misprediction overhead. VPP processes packets in batches (vectors) :

Traditional (scalar):   P1 → P2 → P3 → P4 → ...
VPP (vector):          [P1, P2, P3, P4, ...] → process entire batch at once

Benefits: - Better L1/L2 cache utilization - Reduced instruction pointer changes - Lower per-packet overhead (amortized) - Enables 100+ Gbps throughput on commodity hardware

Node Graph Architecture

VPP processes packets through a directed graph of processing nodes. Each node represents a function (e.g., Ethernet input, IPv4 lookup, ACL check, output interface).

  Physical Input
       ↓
  Ethernet Decode
       ↓
  IPv4 Lookup (FIB)
       ↓
  ACL Check
       ↓
  L4 Forwarding
       ↓
  Rewrite + Output

This graph can be dynamically extended with: - Plugins — Loadable shared objects adding new graph nodes - Custom nodes — Written in C for maximum performance

VPP Features

Feature	Description
L2 Switching	Bridge domains, VLAN tags, MAC learning
L3 Routing	IPv4/IPv6 forwarding, FIB, RIB, BGP (via plugin)
NAT44/NAT64	Carrier-grade NAT, stateful firewall
IPsec	Tunnel/transport mode, hardware crypto offload
MPLS	Label switching, L3VPN, L2VPN
SRv6	Segment Routing over IPv6
ACLs	Packet filtering by IP, port, protocol
QoS	Traffic classification, policing, shaping
Tunnel interfaces	GRE, VXLAN, Geneve, LISP
Telemetry	IPFIX, sFLOW, hardware counters

VPP CLI Basics

# Start VPP
vppctl start

# Show interfaces
vppctl show interface

# Show IP routes (FIB)
vppctl show ip fib

# Show hardware offload status
vppctl show hardware

# Create a loopback interface
vppctl create loopback interface
vppctl set interface ip address loop0 10.0.0.1/24
vppctl set interface state loop0 up

# Add a route
vppctl ip route add 192.168.1.0/24 via 10.0.0.2

# Show NAT sessions
vppctl show nat44 sessions

Performance Characteristics

Metric	Typical VPP Performance
Single-core throughput	10–40 Gbps
Multi-core (NIC RSS)	100–400 Gbps
Packet latency	1–5 μs (fast path)
Cache misses	~2× fewer than kernel stack
Memory footprint	~100 MB

VPP vs Traditional Kernel Stack

Aspect	Kernel (Linux net)	VPP
Processing model	Scalar (one packet)	Vector (batch)
Data plane	In-kernel	Userspace (hugepage-backed)
NIC access	Kernel drivers (NAPI)	DPDK (userspace driver)
Configuration	iproute2, iptables, tc	VPP CLI, VAT, API
Extensibility	Kernel modules, eBPF	Plugins, custom graph nodes
Best for	General purpose	High-throughput NFV

Integration

DPDK — VPP uses DPDK for high-speed NIC access (userspace drivers, zero-copy)
Linux CP — VPP can co-exist with the kernel network stack using a tap/loopback interface
VCL (VPP Communications Library) — LD_PRELOAD library to transparently redirect app sockets through VPP
NSH_SFC — Network Service Header for Service Function Chaining