Hi everybody,

I am writing this email to ask for an opinion about how to address the following problem.

Lately, I have been trying to develop an eBPF program that extracts some per-flow values and stores them into an eBPF HASH_MAP, which is then read by the user-space that extracts the stored information.
When I start reading the map from user-space, all the entries should be deleted at the same time, and the data plane should keep storing the incoming data.
The solution that I have found is to use two maps (and programs) that are continuously swapped when the user-space read is triggered. In this way, when we read the 'old' map, the 'new' map keeps storing the new data.

At the same time, to speed up the lookup and delete operation, I could use the recently added "bpf_map_lookup_and_delete_batch" function to read and clear the map.

Do you think this could be an optimal solution, or are there other more efficient methods?

Thanks in advance for all the suggestions

Best Regards,
Simone