I show how I trace system calls using eBPF to get practical, low-overhead visibility into application behavior. I run small sandboxed programs inside the linux kernel to capture execve, connect, send and recv events. The verifier and JIT keep the approach safe and fast. I explain what you need: a compatible kernel, basic permissions, and […]
The eBPF port scanning detection approach shows how kernel-level programs can answer TCP SYNs without leaving the fast path. I guide you through a compact XDP example that reads Ethernet, IPv4, and TCP headers in the kernel. You will see how a simple program spots a SYN and replies with a SYN-ACK to emulate an […]
Kernel overhead drains CPU cycles through privilege transitions, context switching, and memory isolation. Learn what causes it and how to measure it yourself.
Run `bpftool feature` before you write any code, because an eBPF load balancer only earns its place when you actually need to forward or drop packets before.
bpftool is a virtual package on Ubuntu Noble – install linux-tools-common plus linux-tools-$(uname -r) to get a working binary matched to your kernel.
BCC compiles eBPF C at runtime for deep Linux kernel tracing. Learn when to use BCC versus CO-RE, which tools solve real problems, and how to write safe probes.
Master bpftool for inspecting, loading, and debugging BPF programs. Learn map dumps, program verification, BTF headers, and kernel feature probes.
Falco requires modern eBPF drivers, DaemonSet deployment, rule tuning, and Falcosidekick integration to catch runtime threats in production clusters.
Windows eBPF is production-ready for network filtering and observability, but runs through its own verifier and hooks – not recompiled Linux bytecode.
