Expiring flows in an XDP based router

Hi,

I'm working on an in-house router and I'm looking for some advice on
whether to try to implement some functionality directly in an XDP
program or instead use AF_XDP sockets with the additional flexibility
provided by userspace.

We basically have a flow table, which contains entries of the form:

  (source ip, source port) -> (action, timestamp)

Every time we see a packet belonging to a flow, the timestamp is
updated and if the flow has been inactive for e.g. 10 seconds, the
flow is considered inactive and should be deleted. Actions are of the
form:

  "forward packet to a.b.c.d port X using source port Y"

The challenge that I have is how to clean up expired flows. Built-in
options would be BPF_MAP_TYPE_LRU_PERCPU_HASH. However, dropping an
active flow would be unacceptable.

I'm looking at at most 10k new flow entries being added per second per
router with a maximum number of concurrent flows at around 256k. Each
flow sends a packet at least every 5 seconds, but most every 50ms.
Does this allow me to tune the table size in such a way that no active
flows can be evicted? If not, are there any other reasonable
approaches for cleaning up the flows?

Our current system uses packet headers and is fully stateless, but
adds 16 bytes to every packet.

Best,
Edvard