Apply TC Flower Offload Rules for Hardware-Accelerated VNF Steering

This command installs a tc flower classifier that matches on tunnel metadata and VLAN fields and offloads the action to the NIC's embedded switch, steering traffic into a specific SR-IOV VF. Internally, tc flower parses the packet header and builds a match-action table entry that is pushed down to the NIC ASIC via switchdev. With skip_sw, the rule is enforced only in hardware; if the ASIC cannot program it, the command fails rather than silently falling back to the slow software datapath. The action mirred redirect egress sends matched packets directly to the VF representor.

In production NFV, this is the mechanism used to build service function chains without touching the host CPU, so 100 Gbps of tenant traffic can traverse multiple VNFs at wire speed. It is used in SmartNIC and DPU deployments for 5G UPF and vBNG where software switching would consume all cores. Operators apply it when they need deterministic latency and when the NIC supports representors, such as Mellanox ConnectX-5 and above or Intel E810.

Security implications: hardware offload bypasses the host firewall, so access control must be expressed in the offloaded rules themselves or in the VNF. A misconfigured rule can blackhole or duplicatively mirror traffic, so always verify with tc -s filter show and the NIC's hardware counters. Common pitfalls include tunnel key endianness mismatches, missing representor mode on the PF, and rules silently not offloading because skip_sw was omitted, which destroys performance while appearing to work.

> System.Execute()

ip link set dev ens1f0 vf 0 trust on
ip link set dev ens1f0 vf 0 spoofchk off
tc qdisc add dev ens1f0 ingress_block 1 clsact
tc filter add block 1 ingress protocol ip flower \
  skip_sw dst_ip 10.20.30.40/32 \
  action mirred egress redirect dev ens1f0v0
tc -s filter show block 1 ingress
devlink port show ens1f0

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-351BCD999CEE