A Practical Linux Tcpdump Workflow for Packet Capture
Capture Linux network evidence with tcpdump by choosing the right interface, writing precise filters, saving PCAPs, and validating results with system tools.
Tag: Network traffic analysis
Monitor DNS Traffic with eBPF
eBPF for DNS monitoring gives me precise visibility into queries and responses without touching daemon code. I attach small programs at kernel tracepoints, parse headers, and capture latency where packets flow. I write steps you can run now: build with libbpf, attach at socket tracepoints, and export structured events to a UI like NetObserv. The […]
Create eBPF IDS on Linux
I will walk you through a working eBPF IDS Linux setup that hooks kernel events, streams signals to user space, and keeps performance predictable. I start from how the verifier and JIT work in the linux kernel so you can pick the right attach points. I explain kprobes, tracepoints, uprobes, XDP, and LSM in plain […]
Tracepath on Debian: No-Root MTU Discovery Guide
tracepath finds broken routes and shrinking packet sizes without root access on Debian. Install from iputils-tracepath, run in seconds, skip the sudo hassle.
Monitor Packet Drops with eBPF
You feel the pressure when network flows stall, and packet drop monitoring eBPF is the fastest way to surface the kernel’s reason for loss so you can act with confidence. We outline a practical path—attach an ebpf program to a tracepoint, capture events at the linux kernel, and export clear flow-level data to dashboards. This […]
How Nlbwmon Maps OpenWrt Traffic to Devices
luci-app-nlbwmon attributes OpenWrt traffic to IP and MAC addresses, explains apk versus opkg installs, and helps troubleshoot missing or misleading totals.