BitByteIntegration Cloud-Native Networking Architecture Series Part 5 of 6 — Tracking a Packet Through an SR-IOV Network
Home / Learning / Networking / SR-IOV
📘 Cloud-Native Networking Architecture Series · Part 5 of 6

Tracking a Packet Through an SR-IOV Network

⏱ 20 min read 🔌 Hardware Deep Dive 📊 Advanced

Understanding how KubeVirt and OpenShift Virtualization deliver near-native network performance through PCI passthrough and Virtual Functions.

Reading Time20 min
Architecture LevelAdvanced
AuthorKashif Ali
UpdatedJuly 2026
OpenShift VirtualizationKubeVirtSR-IOVSR-IOV Network OperatorMultusPCI Passthrough
Prerequisites
Read: Part 2 — OVN-Kubernetes Read: Part 4 — UDN & CUDN Basic PCIe / hardware networking familiarity
Cloud-Native Networking Series
Part 1 — Linux Bridge
Part 2 — OVN-Kubernetes
Part 3 — Localnet
Part 4 — UDN & CUDN
Part 5 — SR-IOV
Part 6 — macvlan & IPVLAN
⚡ Quick Facts — What's Actually Different Here
Overlay❌ No
Geneve❌ No
Linux Bridge❌ No
OVS Switching❌ No
Hardware VF✔ Yes
Near-Native Latency✔ Yes
The Series So Far
PartNetwork TypePacket Leaves Node As
Part 1Linux BridgeNative Ethernet
Part 2OVN-KubernetesGeneve Encapsulated
Part 3LocalnetNative Ethernet via br-ex
Part 4UDN / CUDNGeneve — isolated topology
Part 5SR-IOVNative Ethernet — direct from hardware

Why This Matters

Why SR-IOV Exists

Every network type covered in Parts 1 through 4 answered where a packet travels. This article answers a different question entirely: what if a packet could avoid nearly all of that travel?

Even the fastest software path still costs something. A bridge lookup here, an OpenFlow table match there, Geneve encapsulation on top of that, a checksum computed, an interrupt fired, the kernel scheduler deciding when to actually run the code that does all of this. None of it is slow in isolation. All of it adds up — and for workloads measured in microseconds, it adds up to something that matters.

Software Path (Parts 1–4) Application Guest Kernel virtio OVS / OVN / Bridge NIC Hardware Path (SR-IOV) Application Guest Driver Virtual Function (VF) NIC 3 fewer software hops
Diagram 1 — Why SR-IOV: the software path's accumulated hops vs. the hardware path's near-direct route

Eventually, every architect optimizing for latency asks the same question: can we eliminate all of this software processing entirely? The answer is SR-IOV — and the idea that should stay with you through this entire article is simple: the fastest packet is the one that never enters the software datapath.


Section 02 · The Components

Meet the Hardware

ComponentPurpose
PFPhysical Function — the real NIC hardware root
VFVirtual Function — a hardware-isolated slice of the PF
SR-IOV NICThe physical card capable of hardware virtualization
PCIeThe bus that exposes each VF as its own device
IOMMUSecure DMA isolation between VFs and VMs
SR-IOV Network OperatorManages VF lifecycle across the cluster
Device PluginAdvertises VFs as schedulable Kubernetes resources
MultusAttaches the VF to the workload as a network interface
KubeVirtConsumes the VF as the VM's network device
Architecture Note: Nine components, and not one of them is Linux Bridge, OVS, or OVN. This grounding matters before the packet walk — every hop from here on is either silicon or a Kubernetes control-plane object, never the software switching stack from Parts 1–4.

Section 03 · Hero Architecture

SR-IOV Architecture

Before Kubernetes objects enter the picture at all, here's the pure hardware path — because that's genuinely where SR-IOV's story starts.

VMguest OSVF PCI Devicevfio-pciVF Driverkernel bypassPhysical FunctionPF — ens5f0NIC ASIChardware queuesSwitchtrunk port
Diagram 2 — SR-IOV Hardware Architecture: VM → VF PCI Device → VF Driver → Physical Function → NIC ASIC → Switch

A modern SR-IOV-capable NIC doesn't just have one network port — it can partition its own hardware root into isolated virtual slices. A physical interface like ens5f0 can expose Virtual Functions like ens5f0v3, each one a genuinely separate PCI device with its own hardware queue, its own MAC address, and its own place in the NIC's forwarding silicon.

Architecture Note: This is the single most important distinction from every prior article: a VF isn't a software abstraction layered on top of one shared NIC. It's a hardware-enforced partition, recognized as its own PCI device by the operating system.

Section 04

How OpenShift Creates an SR-IOV Network

The hardware exists independent of Kubernetes. Here's how OpenShift discovers it, carves it up, and hands a slice to a VM — the same educational pattern as the UDN lifecycle in Part 4, applied to a completely different technology.

SriovNetworkNodePolicyadmin appliesSR-IOV Operatorwatches CRNIC creates VFshardwareDevice Pluginadvertises resourcesK8s ResourcesschedulableMultusattaches VFVMconsumes
Diagram 3 — Control Plane Lifecycle: from policy manifest to a VM holding a live Virtual Function

A cluster admin applies a SriovNetworkNodePolicy. The SR-IOV Network Operator reads it and instructs the physical NIC to actually create the requested number of VFs in hardware. The Device Plugin then advertises those VFs to Kubernetes as a schedulable resource — not unlike CPU or memory. Multus handles attaching a specific VF to a specific pod or VM at creation time.


Section 05 · Our Signature

The Packet Walk

Same discipline as every article in this series — real addressing, every hop named. This time the hop count is dramatically shorter.

VM192.168.200.10Guest Drivervfio-pciVFens5f0v3PFens5f0, VLAN 200NIC ASICwire-speed tagSwitchtrunk port
Diagram 4 — Complete Packet Walk: 192.168.200.10 exits directly through hardware, no software switching anywhere
1

VM generates the frame

The guest at 192.168.200.10 writes a raw frame directly into its virtual NIC's hardware registers — not a software queue, an actual register the VF exposes.

2

vfio-pci kernel bypass

The guest driver, running the vfio-pci model, moves the frame directly over PCIe. The host kernel's network stack is not involved in this step at all.

3

Virtual Function (ens5f0v3)

The frame lands in the VF's own hardware Tx ring — a queue that belongs exclusively to this VM, with no other workload's traffic sharing it.

4

Physical Function (ens5f0)

The PF's hardware forwarding engine reads the VF's buffer, applies the VLAN 200 tag at wire-speed inside the NIC's own silicon, and prepares the frame for transmission.

5

NIC ASIC — hardware multiplexing

The physical interface's controller handles all packet multiplexing directly in the ASIC. No CPU cycles on the host are spent processing this frame.

6

Physical switch trunk port

The upstream switch receives a tagged, standard 802.1Q frame — configured in trunk mode exactly as it would be for any bare-metal host on VLAN 200.

The Journey, Condensed

VM
Guest Driver
VF
Physical Function
NIC ASIC
Switch
Destination
Architecture Note: Notice everything absent from this walk. No Linux Bridge lookup. No OVS flow table. No OVN logical switch. No Geneve encapsulation. This isn't a shorter version of the OVN packet walk from Part 2 — it's a fundamentally different mechanism.

Section 06

What Actually Happens Inside the NIC?

Most SR-IOV explanations stop at "the VF sends traffic." Here's the layer most of them skip.

PF creates VFhardware root partition Hardware Queueper-VF Tx/Rx ring DMAdirect memory access Wirenative frame Anti-Spoofing Frames not matching the VF's hardware MAC profile are dropped in silicon MSI-X Interrupts Per-queue interrupt vectors let the guest driver poll its own hardware queue directly Queue Isolation Each VF's queue is physically separate — no shared lock, no contention between VMs
Diagram 5 — Inside the NIC: from PF partition to wire, with the three mechanisms that make it fast and safe

When the PF creates a VF, it's allocating a genuinely separate hardware queue — its own Tx/Rx ring, isolated from every other VF's traffic at the silicon level. DMA (Direct Memory Access) lets the NIC write incoming data straight into the VM's memory without the CPU copying it through an intermediate buffer. MSI-X interrupts give each VF its own interrupt vector, so the guest driver can be notified directly rather than waiting on a shared, contended interrupt line.

Architecture Note: Hardware anti-spoofing means the NIC itself — not a software firewall, not an OVN ACL — drops any frame that doesn't match the VF's assigned MAC profile. Security here is enforced in silicon, before the frame ever reaches software.

Section 07 · Recurring Signature

Packet Leaves the Node As...

The series' running comparison, now complete across all five architectures covered so far.

Network TypePacket Leaves Node As
Linux BridgeNative Ethernet
OVNGeneve Encapsulated
LocalnetNative Ethernet
UDNGeneve Encapsulated
SR-IOVNative Ethernet — direct from hardware
Destination MAC6 bytes
Source MAC6 bytes
802.1Q VLAN TagVLAN 200
Payloadzero software modification
CRC4 bytes
Diagram 6 — What leaves the wire: the same native frame structure as Linux Bridge and Localnet, but applied entirely by silicon
Architecture Note: SR-IOV shares its wire format with Linux Bridge and Localnet — native Ethernet, no encapsulation. What makes it different isn't what leaves the wire, it's what happens (or rather, doesn't happen) to get it there.

Section 08

Advantages and Trade-offs

✅ Advantages
  • Very low latency — near-native, wire-speed performance
  • High throughput with minimal CPU overhead
  • Hardware offloads (checksums, VLAN tagging) done in silicon
  • Deterministic performance — no software scheduler jitter
⚖️ Trade-offs
  • Limited workload mobility — VFs are tied to specific physical hardware
  • Finite VF resource limits per physical NIC
  • Hard dependency on SR-IOV-capable hardware being present
  • Live migration requires careful planning, not automatic
  • Higher operational complexity to provision and troubleshoot
Common Misconception: "SR-IOV means giving up flexibility entirely." Not quite — it means trading a specific kind of flexibility (live migration, NetworkPolicy enforcement, dynamic overlay routing) for a specific kind of performance guarantee. Neither is universally correct; each is correct for the right workload.

Section 09

Design Characteristics

FeatureSR-IOV
OverlayNo
OVSNo
Linux BridgeNo
Hardware SwitchingYes
PCI PassthroughYes
Live MigrationLimited / conditional
PerformanceExcellent
FlexibilityLower

Section 10

Common Misconceptions

"SR-IOV bypasses Kubernetes." No. Kubernetes still schedules the workload, still tracks the VF as a resource, and still manages the pod or VM's lifecycle. Only the data path bypasses software switching — the control plane is fully intact.
Control Plane — fully intact Kubernetes Operator Device Plugin Multus → VM Data Plane — bypasses software VM VF NIC Wire
Diagram — Control Plane vs. Data Plane: Kubernetes never leaves the picture; only packet forwarding does
"SR-IOV doesn't need Multus." It commonly does. Multus is what actually attaches a specific VF to a specific workload as a secondary (or primary) network interface — SR-IOV and Multus are typically used together, not as alternatives.
"SR-IOV is just PCI passthrough." Close, but not quite. A VF is a virtual PCI function carved out by the physical NIC itself — it's not the same as dedicating an entire physical NIC to one VM. Multiple VMs can each hold their own VF from the same physical card simultaneously.

Section 11

When Should You Use SR-IOV?

✅ Ideal For
  • Telco CNFs and UPF (User Plane Function) workloads
  • 5G user plane processing
  • DPDK-based applications requiring direct hardware access
  • High-frequency trading systems
  • Low-latency analytics engines
  • High-throughput storage traffic
  • Network appliances (firewalls, load balancers as VMs)
🚫 Avoid For
  • General web applications with no latency sensitivity
  • Elastic, multi-tenant workloads that scale frequently
  • Environments where live migration flexibility is paramount
Latency-critical workload? yes no Need live migration too? Reconsider — see Parts 1–4 SR-IOVthis article Use SDN-based network typesParts 1, 2, 3, or 4
Diagram 7 — Decision Matrix: is SR-IOV actually the right fit for this workload?

Section 12 · The Culmination

SR-IOV vs. Everything Else

Five network types, side by side — the full picture the series has been building toward.

Linux BridgeOVNLocalnetUDNSR-IOV
Switching LayerKernelSDNHybridSDNHardware
OVS InvolvedNoYesYesYesNo
OverlayNoYesNoYesNo
LatencyGoodGoodBetterGoodExcellent
FlexibilityHighHighMediumHighLower
Relative software-path hops before the wire (illustrative) Linux Bridge3 hops OVN5 hops Localnet4 hops UDN5 hops SR-IOV0 hops the packet never enters the software datapath
Diagram 8 — Software-path hop count across the series, illustrated
Architecture Note: Read this table as five different optimization targets, not a ranking. Linux Bridge optimizes simplicity. OVN optimizes flexibility. Localnet optimizes enterprise integration. UDN optimizes isolation. SR-IOV optimizes performance. None of them is "the best" — each is the best fit for a specific set of requirements.

Quick Chooser

Translating five articles of architecture into one lookup table.

RequirementRecommended Network
Lowest latencySR-IOV
Multi-tenancyUDN
Enterprise VLAN integrationLocalnet
General-purpose virtualizationLinux Bridge
Cloud-native overlayOVN-Kubernetes

Section 13

Key Takeaways


Section 14

What's Next

Next: Tracking a Packet Through macvlan & IPVLAN
macvlan & ipvlan

If SR-IOV represents the highest-performance option, what if you want native Ethernet connectivity without specialized hardware? The next article explores macvlan and IPVLAN as lightweight alternatives.

We've now seen the highest-performance option — what's the lightweight middle ground?
Native Ethernet connectivity without requiring SR-IOV-capable hardware
Direct attachment models that don't need PCI passthrough at all
Read Next