NSDI '25#

A triage of NSDI '25 papers for a PM working on physical DC networking, cloud-native networking, network security, and identity. Picks are grouped into Core, Adjacent, and Wildcard tiers. Links point to the USENIX presentation page for each paper, which carries the open-access PDF (and, where posted, slides and video). The program text supplied did not contain per-item pdf:/video: links, so these URLs were resolved against the public USENIX proceedings; slide/video availability varies by paper.

Core#

These map directly onto the PM's day-to-day: container/cloud-native datapaths, eBPF transport, programmable switching, RDMA fabric, micro-segmentation, and routing security.

ONCache: A Cache-Based Low-Overhead Container Overlay Network#

Abstract Paper Slides Recording

• Authors / tier: Shengkai Lin, Shizhen Zhao, Peirui Cao, Xinchi Han (Shanghai Jiao Tong University); Quan Tian, Wenfeng Liu, Qi Wu, Donghai Han (Broadcom); Xinbing Wang (SJTU). Core.

• Why: Overlay networks (VXLAN/Geneve CNIs) are the default in Kubernetes but impose a per-packet tax versus bare metal. This is the exact tradeoff a cloud-native networking PM lives with, and the paper quantifies where the kernel datapath actually spends its time.
• What: The authors profile the overlay datapath segment by segment, observe that most of the extra overhead recomputes the same results across packets of a flow, and cache those invariant results. The result reaches near-bare-metal throughput while keeping overlay flexibility and compatibility.
• How: Three caches (egress, ingress, filter) hold the invariant per-flow results; implemented as four eBPF programs plus three eBPF maps and a small userspace component, in roughly 524 lines of eBPF C — far less than prior approaches like Slim or Falcon. Reported gains: ~12% TCP throughput and ~36% transaction-rate improvement (20%/34% for UDP), with reduced soft-interrupt CPU.
• Where applicable: Broadly applicable to overlay CNIs; the prototype is shipped as an Antrea plugin (Broadcom is a co-author), so the cleanest integration path is Antrea/OVS-based fabrics. The technique itself is CNI-agnostic.

Mitigating Scalability Walls of RDMA-based Container Networks#

Abstract Paper Recording

• Authors / tier: Wei Liu (Tsinghua and Alibaba Cloud); Kun Qian (Alibaba Cloud); Zhenhua Li (Tsinghua); Feng Qian (USC); Tianyin Xu (UIUC); Yunhao Liu (Tsinghua); Yu Guan, Shuhong Zhu, Hongfei Xu, Lanlan Xi, Chao Qin, Ennan Zhai (Alibaba Cloud). Core.

• Why: RDMA-offloaded container networks deliver big wins (the paper shows ~21 Gbps TCP rising to ~180 Gbps once forwarding and VXLAN move to the RNIC and RDMA carries packets), but performance collapses unexpectedly at the scale of millions of containers. Anyone betting on RNIC offload for container fabric needs to understand this ceiling.
• What: The "scalability wall" is traced to the RNICs themselves — design/implementation defects that are invisible because RNIC internals are closed. They build ScalaCN, which infers the most likely causes despite that opacity and proactively reschedules NF offload.
• How: Combinatorial causal testing reconstructs an approximate RNIC architecture and performance model from black-box behavior; ScalaCN then optimizes the network-function offload schedule against that model. On production workloads: ~1.4x end-to-end bandwidth and ~31% lower forwarding latency after resolving 82% of inferred causes. Issues were reported to and confirmed by vendors.
• Where applicable: Production RDMA container networks at hyperscale; evaluation is on Alibaba's production RCN with NVIDIA ConnectX-6 RNICs, so specifics are vendor- and deployment-tied, but the causal-inference methodology for black-box NICs generalizes.

eTran: Extensible Kernel Transport with eBPF#

Abstract Paper Slides Recording

• Authors / tier: Zhongjie Chen (Tsinghua); Qingkai Meng (Nanjing University); ChonLam Lao (Harvard); Yifan Liu, Fengyuan Ren (Tsinghua); Minlan Yu (Harvard); Yang Zhou (UC Berkeley and UC Davis). Core.

• Why: New transport designs almost never reach the mainline kernel, and when they do it takes years. eTran is a credible answer to "how do we get customizable transports into production without forking the kernel" — directly relevant to anyone reasoning about datapath internals and congestion control.
• What: A framework that makes kernel transport extensible: operators implement and customize transports (it ships DCTCP-style TCP and Homa) as eBPF rather than kernel patches, while keeping kernel-level safety and absorbing userspace-transport performance tricks.
• How: Core transport ops run in the kernel via eBPF; packets reach a thin, untrusted userspace library through AF_XDP sockets, where they are reassembled into TCP flows or Homa RPCs. All packets traverse eBPF hooks, so monitoring, access control, and rate limiting are modular eBPF programs chained via bpf_tail_call. Reported up to ~7.5x lower P99 latency than Linux Homa on RPC workloads. Open source.
• Where applicable: Datacenter Linux hosts (evaluated on kernel 6.6.0 with AF_XDP). General technique, but tied to a recent kernel and AF_XDP; synchronization support in eBPF is a noted limitation.

Everything Matters in Programmable Packet Scheduling (PACKS)#

Abstract Paper Slides Recording

• Authors / tier: Albert Gran Alcoz (ETH Zürich); Balázs Vass (BME-TMIT); Pooria Namyar (USC); Behnaz Arzani (Microsoft Research); Gábor Rétvári (BME-TMIT); Laurent Vanbever (ETH Zürich). Core.

• Why: PIFO is the ideal programmable scheduler but can't be built at line rate in hardware. Prior approximations (SP-PIFO, AIFO) each capture only one of PIFO's two behaviors. This advances the "one scheduling abstraction on commodity switches" agenda that matters for anyone tuning FCT on Tofino-class hardware.
• What: PACKS approximates PIFO while capturing both required behaviors — scheduling order and admission control — which prior schemes handled only separately.
• How: Packets are tagged with ranks; PACKS uses a sliding window of recent ranks plus queue-occupancy to make admission decisions, and maps ranks across a small set of priority queues to minimize rank inversions. Reported: up to 7x and 15x fewer rank inversions than SP-PIFO and AIFO, up to 60% fewer drops vs SP-PIFO, and up to 33%/2.6x lower mean FCT for small flows under pFabric ranks.
• Where applicable: Existing programmable switches; implemented in P4 and shown to run at line rate on Intel Tofino. General technique within the constraints of fixed-queue hardware.

Securing Public Cloud Networks with Efficient Role-based Micro-Segmentation (ZTS)#

Abstract Paper Slides Recording

• Authors / tier: Sathiya Kumaran Mani, Kevin Hsieh (Microsoft); Santiago Segarra (Rice); Ranveer Chandra (Microsoft); Yajie Zhou (University of Maryland); Srikanth Kandula (Microsoft). Core.

• Why: Micro-segmentation is the canonical zero-trust control for limiting blast radius, but authoring precise policies at cloud scale is the perennial blocker. This sits squarely in network security and is grounded in real deployment.
• What: ZTS (Zero Trust Segmentation) ingests large volumes of flow logs, infers endpoint roles, and generates micro-segmentation policies automatically, with continuous communication-graph generation and policy enforcement.
• How: Role inference combines domain knowledge with communication patterns rather than relying on manual tagging (which breaks as pods migrate or scale). Evaluated against ground truth across 11 first- and third-party deployments; reported up to 21.5x more cost-efficient than Apache Flink for the stream-processing workload, with higher role-inference accuracy than prior algorithms.
• Where applicable: Large public-cloud networks; built and evaluated inside Microsoft's environment, so the productized form is Azure-flavored, but the role-inference approach is general.

PreAcher: Secure and Practical Password Pre-Authentication by Content Delivery Networks#

Abstract Paper Slides Recording

• Authors / tier: Shihan Lin, Xiaowei Yang (Duke); Suting Chen, Aleksandar Kuzmanovic (Northwestern); Yunming Xiao (University of Michigan); Yanqi Gu (UC Irvine). Core.

• Why: Sits in the identity/authentication lane: it offloads password authentication to CDNs to absorb application-layer DoS against login interfaces, without ever revealing passwords to the CDN. A genuinely novel three-party auth architecture.
• What: A system that inserts a third-party CDN into the password-auth path to pre-authenticate users and filter ADoS traffic before it reaches the origin, while preserving password secrecy and usability.
• How: A three-party (client/CDN/server) protocol combining an Oblivious Pseudorandom Function (OPRF) with Locality-Sensitive Hashing (LSH). The client derives a secret key from the password via OPRF+LSH and interacts with the CDN rather than the server, so the CDN can validate login attempts without learning the password. Demonstrated against a commercial-CDN setup where login-interface ADoS slips past standard WAF/rate-limit protections.
• Where applicable: Web services fronted by CDNs that want login-layer DoS protection; deployable unilaterally by a server operator. General architecture, though it changes the login flow and assumes CDN cooperation.

Achieving Wire-Latency Storage Systems by Exploiting Hardware ACKs (Juneberry)#

Abstract Paper Slides Recording

• Authors / tier: Qing Wang, Jiwu Shu, Jing Wang, Yuhao Zhang (Tsinghua University). Core.

• Why: Touches RDMA datapath internals directly: it questions whether storage requests need a full RPC round trip plus server-CPU involvement to commit, which is relevant to anyone designing lossless-fabric storage paths.
• What: Juneberry gives storage requests a fast path that commits in a single round trip while bypassing the server CPU, with request execution happening asynchronously on the server afterward.
• How: An "Ordered Queue" abstraction treats the NIC's hardware ACK as the commit signal while preserving linearizability; durability comes from landing requests in persistent memory. Built on commodity RDMA NICs and integrated into Memcached and PMemKV, with significantly lower latency than RPC under write-intensive workloads.
• Where applicable: RDMA + persistent-memory storage deployments on commodity RNICs. General mechanism, but the durability story assumes PM availability.

Suppressing BGP Zombies with Route Status Transparency (RoST)#

Abstract Paper Slides Recording

• Authors / tier: Yosef Edery Anahory, Yossi Gilad (Hebrew University of Jerusalem); Jie Kong, Nicholas Scaglione, Justin Furuness, Amir Herzberg, Bing Wang (University of Connecticut); Hemi Leibowitz (College of Management Academic Studies). Core.

• Why: Withdrawal suppression ("zombie" routes that stay active after withdrawal) has been a known BGP weakness for over a decade, with real reliability and security consequences. This is the first systematic defense, relevant to anyone tracking inter-domain routing security alongside RPKI.
• What: RoST lets an AS efficiently and securely verify whether a route has actually been withdrawn, defeating both misconfiguration-driven and adversarial withdrawal suppression.
• How: A verification scheme that is compatible with BGP and composes with existing BGP security enhancements (rather than replacing them). The design targets efficient per-route status checks.
• Where applicable: Inter-domain routing broadly; an incrementally deployable addition to BGP/RPKI-style security rather than a clean-slate redesign.

From Address Blocks to Authorized Prefixes: Redesigning RPKI ROV with a Hierarchical Hashing Scheme#

Abstract Paper Slides Recording

• Authors / tier: Zedong Ni (CNIC, CAS / Southeast University); Yinbo Xu, Hui Zou, Yanbiao Li (CNIC, CAS / UCAS); Guang Cheng (Southeast University / Purple Mountain Labs); Gaogang Xie (CNIC, CAS / UCAS). Core.

• Why: RPKI Route Origin Validation is becoming table stakes for routing security, and its memory/lookup cost on routers is a practical adoption barrier. Directly relevant to the security-and-routing side of the PM's remit.
• What: A redesign of ROV's validation data structure to make origin validation fast and memory-efficient, reframing the problem from address blocks to authorized prefixes.
• How: A hierarchical hashing scheme for prefix-to-authorization lookup. (Specific performance numbers were not captured in this digest pass; confirm them from the paper.)
• Where applicable: Router-side ROV implementations; broadly applicable to any operator deploying RPKI.

Adjacent#

Useful context and near-term influence: DC fabric for ML, transport/queueing, verification tooling, and operator-grade WAN.

Efficient Direct-Connect Topologies for Collective Communications#

Abstract Paper Slides Recording

• Authors / tier: Liangyu Zhao, Tapan Chugh, Arvind Krishnamurthy (University of Washington); Siddharth Pal, Jason Fantl, Prithwish Basu, Joud Khoury (Raytheon BBN); Weiyang Wang (MIT CSAIL). Adjacent.

• Why: Sits at the physical-topology/collective-communication boundary that increasingly drives ML cluster fabric design — relevant context for DC topology and interconnect decisions.
• What: An algorithmic framework that jointly synthesizes direct-connect topologies and their communication schedules, then picks the topology/schedule best suited to a given workload's latency-vs-bandwidth profile and degree constraints.
• How: Start from small optimal base topologies and schedules, then iteratively expand them to large sizes; a novel polynomial-time algorithm produces efficient collective schedules for well-known large-scale graph topologies. Validated on multiple testbeds plus large-scale simulation.
• Where applicable: Degree-constrained direct-connect networks (e.g., optical/cabled interconnects without a central switch). General framework; most valuable where you control the physical topology.

Pyrrha: Congestion-Root-Based Flow Control to Eliminate Head-of-Line Blocking in Datacenter#

Abstract Paper Slides Recording

• Authors / tier: Kexin Liu, Zhaochen Zhang, Chang Liu, Yizhi Wang (Nanjing University); Vamsi Addanki, Stefan Schmid (TU Berlin); additional co-authors at Nanjing University and Huawei. Adjacent.

• Why: Head-of-line blocking in lossless DC fabrics (PFC and friends) is a recurring operational pain. Congestion-root-based flow control is a notable angle for anyone working on RDMA/lossless fabrics.
• What: A flow-control scheme that targets the root of congestion rather than reacting hop-by-hop, aiming to eliminate HoL blocking. (Detailed mechanism not captured in this digest pass; confirm specifics from the paper.)
• Where applicable: Lossless datacenter fabrics; involvement of Huawei co-authors suggests hardware-oriented validation. Treat as fabric-class research relevant to RDMA deployments.

NDD: A Decision Diagram for Network Verification#

Abstract Paper Slides Recording

• Authors / tier: Zechun Li, Peng Zhang, Yichi Zhang (Xi'an Jiaotong University); Hongkun Yang (Google). Adjacent. Awarded Outstanding Paper.

• Why: Network verification underpins config-change safety and reachability analysis. BDDs have been the standard data structure for a decade; an Outstanding Paper that improves the substrate is worth tracking even if you consume verification rather than build it.
• What: Network Decision Diagram (NDD), a data structure customized for verification that natively supports equivalence classes and beats BDD on memory and computation.
• How: NDD wraps BDD in another decision-diagram layer — each NDD node represents a header field, and each edge is labeled with a BDD encoding that field's values. Because field-based matching is local, NDD sharply reduces BDD node counts and makes equivalence-class handling transparent to verifiers. Released as a library; existing verifiers (AP Verifier, APT) were ported to it.
• Where applicable: General — a drop-in substrate for BDD-based verification tools.

Efficient Multi-WAN Transport for 5G with OTTER#

Abstract Paper Slides Recording

• Authors / tier: Mary Hogan (Oberlin College); Gerry Wan (Google); Yiming Qiu (University of Michigan); Sharad Agarwal, Ryan Beckett (Microsoft); Rachee Singh (Cornell); Paramvir Bahl (Microsoft). Adjacent.

• Why: WAN interconnect is core to the PM, and multi-WAN coordination for 5G is an operator-grade problem. The paper shows a way to stitch routes across multiple WANs using existing cloud primitives.
• What: OTTER coordinates transport across multiple WANs to improve performance for 5G traffic, managing route identification and use across providers from one system.
• How: Uses cloud-native components (VNet peering, VPN gateways, firewalls) configured so that VMs in one region can use a gateway in another and carry transit traffic, with scale-up/scale-out per component to span large geographies without per-component code changes; supports asymmetric paths. Reported >25 Gbps between VMs in their GCP topology.
• Where applicable: Multi-cloud/multi-WAN operators; the prototype leans on specific cloud networking features, so it's somewhat provider-configuration-specific.

Mutant: Learning Congestion Control from Existing Protocols via Online Reinforcement Learning#

Abstract Paper Recording

• Authors / tier: Lorenzo Pappone (Saint Louis University); Alessio Sacco (Politecnico di Torino); Flavio Esposito (Saint Louis University). Adjacent.

• Why: Congestion control is core datapath territory; the "learn to switch among existing CCAs online" framing is a pragmatic middle ground between hand-tuned and clean-slate learned CC, worth watching as a design pattern.
• What: An online-RL approach that adapts among existing congestion-control protocols rather than learning one from scratch. (Detailed mechanism and results not captured in this digest pass; confirm from the paper.)
• Where applicable: General transport; treat performance claims as to-be-verified.

Wildcard#

Outside the PM's core focus, but novel enough to be worth the detour.

Towards Energy Efficient 5G vRAN Servers (RENC)#

Abstract Paper Recording

• Authors / tier: Anuj Kalia (Microsoft); Nikita Lazarev (MIT); Leyang Xue (University of Edinburgh); Xenofon Foukas, Bozidar Radunovic (Microsoft); Francis Y. Yan (Microsoft Research and UIUC). Wildcard.

• Why: A surprising result at the intersection of real-time systems and power: you can claw back substantial CPU energy from vRAN servers despite hard sub-millisecond deadlines and black-box proprietary software. The eBPF-based slack-measurement trick is a clever pattern beyond RAN.
• What: RENC saves energy by adjusting CPU frequency in response to sub-second cellular-load variation without missing real-time deadlines.
• How: It establishes safe low-load intervals by coupling MAC-layer rate limiting to frequency changes; computes safe frequencies by measuring deadline slack in vRAN threads via Linux eBPF hooks (or minor binary rewriting of the closed vRAN binary); and handles control-driven load spikes (e.g., new-user attach). Reported up to 45% CPU power reduction (29% server-wide) on a state-of-the-art vRAN testbed.
• Where applicable: vRAN/telco edge servers; the technique is specific to real-time-deadline workloads, but the "measure slack with eBPF, then undervolt/underclock safely" idea generalizes to other latency-critical services.

Quicksand: Harnessing Stranded Datacenter Resources with Granular Computing#

Abstract Paper Slides Recording

• Authors / tier: Zhenyuan Ruan, Kaiyan Fan, Adam Belay (MIT CSAIL); Shihang Li, Malte Schwarzkopf (Brown); Seo Jin Park (USC); Marcos K. Aguilera (VMware Research by Broadcom). Wildcard.

• Why: Stranded resources (memory/CPU that exist but can't be allocated) are a real efficiency drain in datacenters. The granular-computing angle is an emerging subfield a DC-infra PM wouldn't necessarily search for but should see.
• What: A runtime that reclaims stranded datacenter resources by exposing computation at fine (granular) units that can be packed into otherwise-unusable capacity. (Detailed mechanism not captured in this digest pass; confirm from the paper.)
• Where applicable: Datacenter resource scheduling; research-grade, but points at where utilization-efficiency work is heading.

The Benefits and Limitations of User Interrupts for Preemptive Userspace Scheduling#

Abstract Paper Slides Recording

• Authors / tier: Linsong Guo, Danial Zuberi, Tal Garfinkel, Amy Ousterhout (UC San Diego). Wildcard.

• Why: A clear-eyed measurement study of a newer x86 hardware feature (user interrupts) for preemptive userspace scheduling — the kind of "here's what the new primitive actually buys you, and where it doesn't" result that informs datapath and dataplane-OS design.
• What: An evaluation of user interrupts as a mechanism for preemptive scheduling in userspace, characterizing both the wins and the limits rather than pitching a single system.
• Where applicable: Userspace network/dataplane stacks and low-latency runtimes on hardware that supports user interrupts. General, forward-looking.

Themes#

• eBPF as the universal kernel-extension substrate. It shows up across very different problems this cycle — overlay-network acceleration (ONCache), extensible transport (eTran), and even real-time power management (RENC measuring deadline slack). The pattern is "customize the kernel datapath safely, in production, without forking it."

• Closed hardware, inferred from the outside. Multiple papers cope with black-box silicon and binaries by building approximate models: ScalaCN reconstructs RNIC behavior via causal testing; RENC reasons about a proprietary vRAN binary. Expect more "reverse-model the device you can't see inside" methodology.

• ML clusters are reshaping the fabric agenda. Collective-communication topologies (Direct-Connect), LLM-training resilience and simulation, and disaggregated/granular resource reclamation occupy a large share of the program — the network is increasingly designed around training and inference traffic.

• Programmable scheduling and queueing keep maturing. PACKS, ClubHeap, and Self-Clocked Round-Robin all push on approximating ideal schedulers (PIFO) within real switch constraints, signaling the "one scheduling abstraction on commodity hardware" goal is still very active.

• Routing security is consolidating around incremental, deployable defenses. RoST (BGP withdrawal suppression) and the RPKI ROV redesign both aim to compose with existing BGP/RPKI rather than replace it, with an emphasis on memory/lookup efficiency on real routers.

• Verification and testing are broadening past the data plane. NDD (an Outstanding Paper) rethinks the core data structure; alongside P4 temporal verification, eBPF verification (VEP), service-mesh testing (MeshTest), and protocol-refinement checking, the field is investing in correctness tooling across the whole stack.