How Kernel Executors Dispatch Compute to Hardware
Kernel executors route compiled kernels to devices and manage dependencies. Learn how OpenCL queues, PyTorch dispatch, and backend delegates actually work.
Tag: eBPF
Build eBPF on ARM: Check the Kernel Before Clang
eBPF portability depends on the target kernel, not just the CPU. This guide covers clang, libbpf, CO-RE, BTF, verifier checks, and ARM loading.
eBPF JIT Verification Offload Tutorial for Linux Kernel Experts
I tested an eBPF JIT verification offload design because load-time checks slow my workflow—and I wanted a safe, auditable path that kept runtime behavior unchanged. I felt the tension: native machine code running in kernel mode is powerful, and a single bad decision can break security or memory safety. Here I state the key idea […]
How eBPF Intercepts Packets Before Kernel Routing
eBPF programs redirect packets at XDP or TC hooks before the kernel routing table is consulted, causing routing confusion when troubleshooting.
Use eBPF to Trace VPN Traffic Across Encryption
The right eBPF hooks expose plaintext on tun0 or wg0 and ciphertext on the NIC, with practical guidance on correlation, probes, and failure diagnosis.
OpenWrt Traffic Monitor: Read Raw Kernel Data First
Skip dashboards for unreliable counts. Start with /proc/net/dev and tc qdisc, then layer nlbwmon for per-IP accountability on OpenWrt routers.
XDP SYN Flood Protection: Building eBPF Defenses
Build an eBPF XDP program that stops SYN floods at the NIC driver with per-IP rate limiting, hash maps, and line-rate packet drops before the kernel stack.
Build OpenWrt eBPF: Kernel Config & Toolchain Guide
Enable eBPF on OpenWrt by configuring kernel flags, building custom firmware, and verifying support with bpftool – complete setup steps for routers.
XDP Firewall on OpenWRT: Early Packet Drop at Line Rate
XDP intercepts packets in the driver before the kernel allocates buffers, enabling high-volume DDoS mitigation and load balancing with minimal CPU cost.
How to Build an eBPF Trace That Answers One Question
A focused eBPF trace starts with logs and strace, then uses the right hook, attribution fields, and verifier-safe code to answer one question.
Profile Kernel Performance With eBPF: What to Know First
Use bpftrace for a quick question, BCC for repeatable scripts, perf for traditional sampling, and Rust with Aya only when existing tools cannot express.
Kernel Overhead: What It Is and How eBPF Cuts It
Kernel overhead drains CPU cycles through privilege transitions, context switching, and memory isolation. Learn what causes it and how to measure it yourself.
Block IP Addresses With eBPF: XDP Attach Syntax
Load and attach XDP programs to network interfaces using bpftool and ip link pinned syntax. Master the two-step process: pin first, then attach to eth0.
eBPF Load Balancer: XDP Forwarding at Line Rate
Run `bpftool feature` before you write any code, because an eBPF load balancer only earns its place when you actually need to forward or drop packets before.
Probe Shell Errors: Trace the Real Process
Most probe shell failures come from a mismatched process, account, or environment. Trace execve, logs, paths, and integration to isolate the real cause.
Mount Bpffs at /Sys/fs/bpf: CAP_SYS_ADMIN and Persistence
bpffs mount requires CAP_SYS_ADMIN for both the mount and bpf() syscall. Learn how to diagnose failures, make mounts persistent, and secure pins across reboots.
XDP Offload vs Native: Which Mode Runs on Your Hardware
XDP offload runs programs on the NIC processor, not your CPU. Learn which modes actually use hardware and how to verify your real attach mode.
What Kernel Times Mean and How to Fix Them
Kernel times show OS overhead on your CPU. Learn what drives them high, how to spot driver problems in Task Manager, and the tools to diagnose the real culprit.
Linux Syscall Tracing: Find Latency in 3 Steps
Diagnose Linux latency by tracing syscalls with strace, perf trace, or BCC tools. Learn which tool fits production vs development and how to read the results.
How Pixie Uses eBPF for Kubernetes Visibility
Pixie uses eBPF to expose Kubernetes HTTP, gRPC, TLS, database, and network telemetry without code changes, while showing where kernel-level visibility ends.
Operationalizing Falco: eBPF Driver Setup and Alert Routing
Falco requires modern eBPF drivers, DaemonSet deployment, rule tuning, and Falcosidekick integration to catch runtime threats in production clusters.
Katran XDP Load Balancer: Kernel-Native Packet Forwarding
Katran forwards packets at the NIC receive path using eBPF and XDP, eliminating userspace overhead and lock contention to hold at Facebook scale.
Cilium eBPF Use Cases: Where It Earns Its Complexity
Cilium eBPF use cases include identity-based policy, service load balancing, and flow visibility, with clear limits for custom tooling and basic networking.
OpenWrt eBPF Kernel Setup: Which Options to Enable
Build OpenWrt with working eBPF support by enabling the right kernel symbols, matching options to XDP, tc, tracing, or BTF, and checking JIT support.