Build a Portable CO-RE eBPF Loader With Libbpf
Trace a CO-RE eBPF program from BTF generation and Clang compilation through libbpf skeleton loading, verifier logs, attachment, and cleanup.
Tag: eBPF tools
Preverify eBPF Programs in CI Before Kernel Load
Run the kernel verifier off-device during CI to catch eBPF rejections early. Learn verifier basics, log reading, BTF fixes, and troubleshooting methods.
Build OpenWrt eBPF: Kernel Config & Toolchain Guide
Enable eBPF on OpenWrt by configuring kernel flags, building custom firmware, and verifying support with bpftool – complete setup steps for routers.
How to Build an eBPF Trace That Answers One Question
A focused eBPF trace starts with logs and strace, then uses the right hook, attribution fields, and verifier-safe code to answer one question.
Profile Kernel Performance With eBPF: What to Know First
Use bpftrace for a quick question, BCC for repeatable scripts, perf for traditional sampling, and Rust with Aya only when existing tools cannot express.
Detect Port Scans with eBPF
The eBPF port scanning detection approach shows how kernel-level programs can answer TCP SYNs without leaving the fast path. I guide you through a compact XDP example that reads Ethernet, IPv4, and TCP headers in the kernel. You will see how a simple program spots a SYN and replies with a SYN-ACK to emulate an […]
Kernel Overhead: What It Is and How eBPF Cuts It
Kernel overhead drains CPU cycles through privilege transitions, context switching, and memory isolation. Learn what causes it and how to measure it yourself.
eBPF Load Balancer: XDP Forwarding at Line Rate
Run `bpftool feature` before you write any code, because an eBPF load balancer only earns its place when you actually need to forward or drop packets before.
Why Apt Says Bpftool Is a Virtual Package (and the Fix)
Two packages, not one: linux-tools-common plus linux-tools-$(uname -r) gets bpftool working on Ubuntu, with checks for virtual package and pocket errors.
BCC eBPF Compiler for Linux Kernel Tracing
BCC compiles eBPF C at runtime for deep Linux kernel tracing. Learn when to use BCC versus CO-RE, which tools solve real problems, and how to write safe probes.
Bpftool: BPF Program Inspection and Debugging Guide
Master bpftool for inspecting, loading, and debugging BPF programs. Learn map dumps, program verification, BTF headers, and kernel feature probes.
How Pixie Uses eBPF for Kubernetes Visibility
Pixie uses eBPF to expose Kubernetes HTTP, gRPC, TLS, database, and network telemetry without code changes, while showing where kernel-level visibility ends.
Operationalizing Falco: eBPF Driver Setup and Alert Routing
Falco requires modern eBPF drivers, DaemonSet deployment, rule tuning, and Falcosidekick integration to catch runtime threats in production clusters.
eBPF for Windows: Network Filtering and Observability
Windows eBPF is production-ready for network filtering and observability, but runs through its own verifier and hooks – not recompiled Linux bytecode.