The Cilium datapath is the set of eBPF programs and kernel hooks that handle pod traffic on each Linux node. For any packet, it decides whether the destination is a local endpoint, a remote pod reachable through Linux routing, or a Kubernetes Service that must be translated to a backend. Which path runs, and what happens along the way, depends on three choices: the routing mode, the kernel features on the node, and whether kube-proxy is replaced.
This article reflects Cilium’s documentation as of October 2026, with the stable material covering the 1.20.x series. Routing, Service and kernel details change between releases, so confirm them against the version you deploy.
As an Amazon Associate I earn from qualifying purchases.
What the datapath is
Every pod gets a network endpoint on its node, connected to the node’s network stack. Cilium attaches eBPF programs to the Linux networking path. Those programs read eBPF maps, kernel data structures that hold lookup state such as endpoint and policy information, and the agent keeps them updated. Cilium’s eBPF datapath documentation describes this packet handling and the supporting maps.
Recommended Free Tools
Two points frame the rest of the explanation. First, Cilium is the packet-processing layer, not the whole network. It decides what happens to a packet on the node, but moving a packet between nodes still depends on the underlay network. Second, the exact hooks and their order differ by configuration, so the sequences below show the logical flow rather than a fixed kernel path.
#1 Best Overall
Following a packet through the three paths
Cilium’s datapath documentation organizes the flow into three paths: endpoint-to-endpoint traffic, egress from an endpoint, and ingress to an endpoint. Following them in that order shows where each decision is made.
Endpoint-to-endpoint traffic
When both pods run on the same node, the packet does not need the underlay. Cilium’s programs identify the destination endpoint, apply policy, and deliver the packet to it directly. A destination on another node is not local, so the packet follows the egress path instead.
Egress from an endpoint
For a packet leaving a pod, the logical sequence is:
- The packet leaves the pod’s network namespace through its virtual interface on the node.
- Cilium’s eBPF programs evaluate policy and resolve the destination. If the address is a Kubernetes Service IP and kube-proxy replacement is enabled, the Service is translated to a backend pod at this stage.
- If the destination is a local endpoint, the packet is delivered to it, as in the endpoint-to-endpoint path.
- If the destination is outside the node, the packet goes to the node’s routing. In native routing mode, Cilium passes it to Linux routing. In tunnel mode, it is encapsulated and sent toward the node that hosts the destination.
Ingress to an endpoint
For a packet arriving at a node:
- The packet arrives from the underlay, either from another node or from outside the cluster.
- If the destination is a local endpoint, Cilium’s ingress programs apply policy for that endpoint.
- The packet is delivered to the endpoint’s interface and into the pod.
Routing mode decides how remote packets reach their destination
Cross-node traffic is where the datapath meets the network. Cilium’s routing documentation describes native routing mode as one in which Cilium delegates packets not destined for a local endpoint to Linux routing. Cilium does not create underlay reachability for those packets. The cluster must already be able to route the remote pod address space, through one of these means:
Rank #3
- Cloud network integration that programs routes for pod addresses.
- Direct routes between nodes on a shared Layer 2 network.
- A routing component that distributes pod routes between nodes.
If none of these is present, a node has no route for a remote pod IP, and the packet has nowhere to go. This usually appears as failed connections between pods on different nodes, while same-node traffic keeps working.
The table compares the two approaches at the level this article covers. It does not compare the tunnel mode’s trade-offs in depth; the routing documentation for your release is the reference for that.
| Aspect | Native routing | Tunnel (encapsulated) routing |
|---|---|---|
| Packet between nodes | Sent unencapsulated to Linux routing | Encapsulated before it crosses the underlay |
| Pod-address reachability | Supplied by the cluster network (the sources listed above) | Carried by the tunnel between nodes |
| Underlay requirement | Routes to remote pod address ranges must exist | Node-to-node IP reachability |
Services: kube-proxy or Cilium’s eBPF replacement
Kubernetes Services are normally translated by kube-proxy. Cilium can perform that translation itself in its eBPF datapath, which is what kube-proxy replacement means. The Service-to-backend lookup moves out of kube-proxy’s rules and into Cilium’s maps, so translation happens inside the programs described above rather than in a separate proxy layer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What changes for traffic
Replacing kube-proxy changes who owns several behaviors:
Best Value
- Service translation and load balancing run in Cilium’s eBPF path instead of kube-proxy.
- Service traffic policies are configurable, and the policy you choose determines which backends receive traffic.
- Source IP preservation depends on the configured mode, which determines the address a backend sees.
Limits to check before replacing kube-proxy
- SCTP support is limited to a few basic cases, according to Cilium’s kube-proxy replacement documentation.
- Socket-level load balancing raises kernel-related concerns for some workloads. The documentation names NFS and SMB mounts made through a Service IP.
- Cilium’s Istio integration documentation recommends keeping kube-proxy for minimal disruption in common Istio modes. Full replacement requires additional settings.
Treat kube-proxy replacement as a configuration project rather than a switch. Choose the traffic policy and source IP mode your workloads need, confirm that the kernel supports them, and test storage and mesh traffic before rolling the change out.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Kernel capabilities and the iptables fallback
Not every datapath feature runs purely in eBPF on every node. Feature availability depends on the kernel. Where a required capability is missing, Cilium documents legacy iptables as the fallback for that function. A cluster can therefore use eBPF for some paths and iptables for others. Host routing and other optimizations can also change which hooks and tables see a given packet.
netkit requires kernel 6.8 or newer
Cilium’s tuning guide states that netkit requires kernel 6.8 or later and eBPF host routing. netkit cannot be enabled in place on existing veth-based Pods. A migration therefore takes effect as Pods are created or restarted, or as nodes are replaced. Until those Pods are recreated, they keep their veth interfaces. Do not apply this minimum to other Cilium features, since each has its own requirements.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →When iptables is still in the path
Cilium’s iptables usage documentation describes this fallback. Its wording comes from the development documentation rather than a specific stable release, so check the behavior against the release you run before relying on it for deployment decisions.
Quick Recap
Checks to run on a node
- Confirm the kernel version on each node with
uname -r. netkit needs 6.8 or later. - Confirm the routing mode and the kube-proxy replacement setting in your Cilium installation configuration.
- If you use native routing, check that remote pod addresses have a route. Run
ip route get <remote-pod-IP>on the source node. Output showing a next hop and a device means Linux can route the packet. A “Network is unreachable” error means no route exists, and the fix belongs in the cluster network rather than in Cilium’s configuration. - If a Service fails only for some clients, check its traffic policy and source IP mode before changing backends.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
