Use eBPF to Trace VPN Traffic Across Encryption
The right eBPF hooks expose plaintext on tun0 or wg0 and ciphertext on the NIC, with practical guidance on correlation, probes, and failure diagnosis.
Category: Kernel Observability
OpenWrt Traffic Monitor: Read Raw Kernel Data First
Skip dashboards for unreliable counts. Start with /proc/net/dev and tc qdisc, then layer nlbwmon for per-IP accountability on OpenWrt routers.
Profile Kernel Performance With eBPF: What to Know First
Use bpftrace for a quick question, BCC for repeatable scripts, perf for traditional sampling, and Rust with Aya only when existing tools cannot express.
Kernel Overhead: What It Is and How eBPF Cuts It
Kernel overhead drains CPU cycles through privilege transitions, context switching, and memory isolation. Learn what causes it and how to measure it yourself.
Mount Bpffs at /Sys/fs/bpf: CAP_SYS_ADMIN and Persistence
bpffs mount requires CAP_SYS_ADMIN for both the mount and bpf() syscall. Learn how to diagnose failures, make mounts persistent, and secure pins across reboots.
What Kernel Times Mean and How to Fix Them
Kernel times show OS overhead on your CPU. Learn what drives them high, how to spot driver problems in Task Manager, and the tools to diagnose the real culprit.
Linux Syscall Tracing: Find Latency in 3 Steps
Diagnose Linux latency by tracing syscalls with strace, perf trace, or BCC tools. Learn which tool fits production vs development and how to read the results.
Monitor Packet Drops with eBPF
You feel the pressure when network flows stall, and packet drop monitoring eBPF is the fastest way to surface the kernel’s reason for loss so you can act with confidence. We outline a practical path—attach an ebpf program to a tracepoint, capture events at the linux kernel, and export clear flow-level data to dashboards. This […]