Zero-Copy Fast Path
Packets never leave the NIC DMA region. The engine reads, classifies, and forwards from the same shared-memory ring — without a single kernel copy.
Walk through a single flow
- 1Packets land directly in shared-memory rings mapped from the NIC into the engine's address space.
- 2A single worker walks the ring by index — no packet buffer allocation, no socket queue.
- 3Decisions — pass, drop, or re-inject — are made and executed in place on the same ring.
- 4Batches of packets are processed together for cache-friendly traversal.
Technical notes
Traditional inspection stacks copy every packet from the NIC into kernel buffers, then again into userspace. Zedmos eliminates both copies by mapping the NIC ring directly into the engine — every stage of inspection, from DPI to TLS to policy, operates on the same memory.
Before the engine starts, a validation routine inspects the interface for native fast-path capability. Unsupported combinations surface a clear fallback path, with no surprise during production runtime.
Measured numbers
Monitor mode, 256-packet batch, CPU affinity — no policy enforcement.
Bridge mode with the suffix-trie policy engine active; 5-8 % CPU.
Amortised call overhead: four calls per 256 packets instead of four per packet. Not the total per-packet cost.