Trace VPN Tunnels With eBPF at Both Network Layers
The guide shows how to monitor VPN tunnels with eBPF by correlating outer and inner traffic, sockets, processes, interfaces, and control-plane state.
Category: eBPF Use Cases
Protect Linux from DDoS with eBPF
I build small, safe kernel programs that stop high-rate packet floods at the NIC driver level so the system stays responsive under stress. XDP runs before the Linux networking stack, letting an ebpf program parse headers, count packets per source IP, and drop bursts with minimal latency. My approach uses a BPF hash map keyed […]
Monitor DNS Traffic with eBPF
eBPF for DNS monitoring gives me precise visibility into queries and responses without touching daemon code. I attach small programs at kernel tracepoints, parse headers, and capture latency where packets flow. I write steps you can run now: build with libbpf, attach at socket tracepoints, and export structured events to a UI like NetObserv. The […]
Trace System Calls with eBPF
I show how I trace system calls using eBPF to get practical, low-overhead visibility into application behavior. I run small sandboxed programs inside the linux kernel to capture execve, connect, send and recv events. The verifier and JIT keep the approach safe and fast. I explain what you need: a compatible kernel, basic permissions, and […]
Create eBPF IDS on Linux
I will walk you through a working eBPF IDS Linux setup that hooks kernel events, streams signals to user space, and keeps performance predictable. I start from how the verifier and JIT work in the linux kernel so you can pick the right attach points. I explain kprobes, tracepoints, uprobes, XDP, and LSM in plain […]
Block IP Addresses With eBPF: XDP Attach Syntax
Load and attach XDP programs to network interfaces using bpftool and ip link pinned syntax. Master the two-step process: pin first, then attach to eth0.
eBPF Load Balancer: XDP Forwarding at Line Rate
Run `bpftool feature` before you write any code, because an eBPF load balancer only earns its place when you actually need to forward or drop packets before.
Katran XDP Load Balancer: Kernel-Native Packet Forwarding
Katran forwards packets at the NIC receive path using eBPF and XDP, eliminating userspace overhead and lock contention to hold at Facebook scale.