Every packet entering a server needs processing: headers parsed, routing decisions made, encryption applied, overlay tunnels terminated. At 25 GbE, 100 GbE, and beyond, doing all of that on the host CPU becomes expensive. Cloud providers have measured a significant fraction of CPU cycles — often in the 20–30% range on network-heavy workloads — consumed by IPsec, VXLAN tunnel processing, and TCP stack overhead. In a multi-tenant virtualized environment, those cycles belong to customers but are quietly spent on infrastructure plumbing.

This is the “data plane tax,” and it’s the problem that smart network interface cards — SmartNICs, and their more capable relatives, Data Processing Units (DPUs) — are designed to eliminate.

What Makes a NIC “Smart”

A traditional NIC is mostly passive: it puts bytes into memory and raises interrupts. A SmartNIC adds programmable logic to that path. Basic variants use FPGAs or ASICs for checksum computation and segmentation offload — capabilities that have been standard for years and are now table stakes.

A full DPU goes further. It integrates a multi-core ARM processor complex, dedicated memory, a network switching fabric, and hardware accelerators for cryptography and compression — all on a PCIe card. The card runs its own OS and has its own management plane, independently administered from the host. The key architectural shift: the DPU is a peer of the host CPU rather than a peripheral. It can inspect, transform, and route traffic without involving the host CPU at all.

What Gets Offloaded

The most common workloads pushed to DPUs fall into a few categories.

Overlay networking. Cloud environments carry tenant traffic encapsulated in VXLAN or Geneve tunnels. Terminating those tunnels, rewriting headers, and enforcing security group rules can move entirely to the DPU, freeing the host CPU for application work.

Encryption. TLS and IPsec are computationally expensive at line rate. DPUs include dedicated cryptographic engines that sustain throughput without touching host CPU cycles — this matters especially for storage protocols like NVMe-over-Fabrics with encryption in transit.

Storage. NVMe-oF allows servers to access remote SSDs over fabric with near-local latencies. A DPU can handle protocol translation and I/O scheduling on behalf of the host, reducing both latency and CPU overhead simultaneously.

Observability and security. The DPU sits in the critical path of all traffic, giving it a privileged view of everything entering and leaving the host. That makes it useful for enforcing policy and detecting anomalies without trusting the tenant’s OS — an important property in shared infrastructure.

The Tradeoffs

DPUs are not free. Programming them means working in a separate execution environment — typically a trimmed-down Linux on the ARM cores — with its own toolchain, debugging workflow, and software lifecycle. Updating NIC firmware independently of the host adds operational surface area that teams need to account for.

There is also a performance envelope to understand. Fixed-function offload for well-defined operations like AES-GCM encryption runs at line rate and is straightforward. More flexible workloads expressed as eBPF programs run on the ARM cores and have throughput limits that vary by vendor and program complexity. Not everything that runs fast on a host CPU will run fast on a DPU.

The cost premium over a standard NIC is substantial. The economics only work when the host CPU cycles recovered are worth more than the card costs. At cloud scale, that tradeoff is often favorable. For a single on-premises deployment, it may not be.

Where This Fits in the Broader Architecture

DPUs are part of a wider offload trend. The same logic that moves storage I/O off the kernel (io_uring), processing onto specialized hardware (GPUs, SIMD), and networking out of the kernel (DPDK, XDP) applies here. The general-purpose CPU is excellent at branchy, latency-sensitive, single-threaded code; it is not the most efficient engine for high-throughput, repetitive data-plane work, and the industry keeps finding new ways to route that work elsewhere.

As network speeds continue rising — 400 GbE ports are available in high-end switches today — the gap between what a CPU can process and what arrives on the wire keeps widening. DPUs are a structural answer to that gap. Whether you encounter them as a cloud tenant (where they may already be silently handling your workload’s network plumbing) or as an infrastructure engineer evaluating hardware, understanding what they offload and what they cost in complexity is increasingly relevant to how modern servers actually work.