Build a Portable CO-RE eBPF Loader With Libbpf
Trace a CO-RE eBPF program from BTF generation and Clang compilation through libbpf skeleton loading, verifier logs, attachment, and cleanup.
Tag: eBPF programming
CONFIG_BPF_SYSCALL: The Kernel Flag eBPF Programs Need
CONFIG_BPF_SYSCALL compiles the bpf() syscall into your kernel, the single entry point every eBPF program load and firewall rule requires to work.
Preverify eBPF Programs in CI Before Kernel Load
Run the kernel verifier off-device during CI to catch eBPF rejections early. Learn verifier basics, log reading, BTF fixes, and troubleshooting methods.
How to Build an eBPF Trace That Answers One Question
A focused eBPF trace starts with logs and strace, then uses the right hook, attribution fields, and verifier-safe code to answer one question.
Block IP Addresses With eBPF: XDP Attach Syntax
Load and attach XDP programs to network interfaces using bpftool and ip link pinned syntax. Master the two-step process: pin first, then attach to eth0.
Probe Shell Errors: Trace the Real Process
Most probe shell failures come from a mismatched process, account, or environment. Trace execve, logs, paths, and integration to isolate the real cause.
Mount Bpffs at /Sys/fs/bpf: CAP_SYS_ADMIN and Persistence
bpffs mount requires CAP_SYS_ADMIN for both the mount and bpf() syscall. Learn how to diagnose failures, make mounts persistent, and secure pins across reboots.
BCC eBPF Compiler for Linux Kernel Tracing
BCC compiles eBPF C at runtime for deep Linux kernel tracing. Learn when to use BCC versus CO-RE, which tools solve real problems, and how to write safe probes.
Bpftool: BPF Program Inspection and Debugging Guide
Master bpftool for inspecting, loading, and debugging BPF programs. Learn map dumps, program verification, BTF headers, and kernel feature probes.
Katran XDP Load Balancer: Kernel-Native Packet Forwarding
Katran forwards packets at the NIC receive path using eBPF and XDP, eliminating userspace overhead and lock contention to hold at Facebook scale.
eBPF for Windows: Network Filtering and Observability
Windows eBPF is production-ready for network filtering and observability, but runs through its own verifier and hooks – not recompiled Linux bytecode.