This article explains how zero‑intrusion eBPF technology enables detailed, non‑disruptive TCP network monitoring, covering data collection interfaces, aggregation methods, implementation steps, usage limitations, and practical installation and visualization guidance for improving network performance and fault analysis.
The article explains how to use eBPF tracepoints to monitor and record changes in Linux process capabilities, detailing the kernel data structures, BPF program logic, and user‑space handling needed to debug real‑world capability issues such as tcpdump failures and systemd service launches.
The article explains how attackers exploit SUID binaries for privilege escalation and demonstrates how to use eBPF LSM hooks (file_open, bprm_check_security) and Kprobe tracing to audit such operations, then shows how to block them by returning error codes while exempting root users.
netcap is an open‑source eBPF‑driven kernel network packet capture tool that extends tcpdump syntax to trace skb‑related functions across the Linux network stack, offering detailed packet tracing, customizable filters, multi‑trace aggregation, and user‑defined output to improve debugging of packet loss and performance issues.
At the recent virtual eBPF summit, Isovalent CTO Thomas Graf revealed that Microsoft is developing a Windows version of eBPF, aiming for cross‑platform compatibility with Linux, while the IETF works on standardizing the eBPF ISA and verifier to ensure secure, portable kernel bytecode execution.
This article walks through the Linux kernel mechanisms for creating and destroying processes, covering copy‑on‑write, the fork/vfork/clone system calls, the kernel_clone implementation in kernels 5.0 and 6.5, the copy_process workflow, and the steps the kernel takes to wake up a new task and clean up a terminated one.
Kyanos is an open‑source command‑line utility that leverages eBPF to provide low‑overhead, kernel‑compatible network tracing and performance analysis for HTTP, MySQL, and Redis traffic, offering simple watch and stat commands that replace slow tcpdump workflows with seconds‑level diagnostics.
This article explains how kube-proxy and CNI plugins cooperate within a Kubernetes cluster to translate Service ClusterIP requests into real Pod IPs, detailing the Netfilter, iptables/ipvs rule configuration, overlay networking modes, and the emerging proxy‑free approaches using eBPF.
retsnoop is an eBPF‑based tracing utility that uses wildcard patterns to hook kernel functions, automatically captures full stack traces whenever a function returns an error, and offers three complementary modes—stack trace, function‑call trace, and LBR—to quickly pinpoint the source of kernel failures, with practical examples and source‑code insights.
This tutorial shows how to use eBPF, bpftrace, and the funclatency tool to instrument key Nginx functions, measure their execution latency, analyze the distribution of request processing times, and identify performance bottlenecks for optimization.
This article walks through removing the per‑CPU map used to pass the TCP‑option offset in an XDP program, shows the required code changes, explains the verifier errors that arise, and presents the final fix using an int offset with a bitwise mask.
The presentation outlines Alibaba Cloud's ACK container service observability framework, covering its architecture, key capabilities such as eBPF‑based tracing, GPU profiling, network diagnostics, storage monitoring, and FinOps integration, and demonstrates how these features support AI workloads, large‑scale production stability, and automated incident response.
The article explains the motivation, design, and API of the new multi‑producer single‑consumer eBPF Ring Buffer, compares it with perf buffers and other alternatives, and provides complete BPF and userspace code examples demonstrating reservation, commit, and polling of events while preserving ordering across CPUs.
This article explains why packets are dropped in Linux, introduces the kfree_skb_reason API added in kernel 5.17, and shows step‑by‑step how to use bpftrace to capture drop reasons, five‑tuple details, and stack traces for precise network debugging.
Observability turns a black‑box application into a system by gathering logs, metrics, and traces, using alerts to spot anomalies, then linking trace IDs to logs; OpenTelemetry standardizes this with instrumented client agents, a Collector (receivers, processors, exporters), and backend storage, while Java agents, span propagation, exemplars, eBPF, and bundles like SigNoz or OpenObserve let teams choose between a custom OTel stack or a solution.
This article explains how to monitor MySQL slow queries by attaching eBPF uprobe/uretprobe probes to the dispatch_command function, handling symbol mangling across MySQL versions, and processing the captured data in a Go program to display latency and SQL statements.
This article explains how to monitor Go goroutine state transitions without modifying source code by attaching eBPF uprobes to the runtime.casgstatus function, defining a custom data struct, using a ring buffer to deliver events, and processing them in a Go user‑space program.
This article explains how to use eBPF fentry and fexit probes to monitor the Linux unlink system call, compares them with kprobes, provides complete C and Go examples, shows compilation with eunomia‑bpf, and discusses the low‑overhead advantages of fentry for kernel tracing.
This article explains how to use Linux eBPF kprobe (and kretprobe) to dynamically instrument the unlink system call, covering the underlying concepts, required kernel headers, full eBPF source code, compilation with both eunomia‑bpf and cilium/ebpf, and a detailed comparison with tracepoint probes.
This tutorial walks through installing the required toolchain, writing a minimal eBPF program, compiling it with eunomia‑bpf or cilium/ebpf, loading it from user space, attaching it to a tracepoint, and observing kernel‑level output, while explaining each step and the underlying concepts.
This article introduces eBPF fundamentals, explains the Compile‑Once‑Run‑Everywhere (CO‑RE) approach, compares it with traditional eBPF, outlines best practices, and walks through a complete Go‑based example using the Cilium/eBPF library and the eunomia‑bpf runtime.
This guide walks through the purpose, advantages, required Linux packages, Go libraries, exact installation commands, and version details needed to set up a functional eBPF development environment on an Ubuntu system, while explaining each step’s rationale.
By deploying eBPF agents as DaemonSets that hook kernel network and performance events, the Xiaohongshu observability team extended cloud‑native monitoring from the application to the kernel, delivering real‑time traffic analysis and low‑overhead continuous profiling for C++ services, aggregating data into centralized collectors for dashboards, flame‑graphs, and rapid root‑cause diagnosis.
This article walks through creating a first eBPF program using C and Go on Ubuntu 22.04, covering required dependencies, kernel‑space vs user‑space concepts, event selection, BPF map definition, and a tracepoint function that measures per‑process CPU time.
This article explains the challenges of manual OpenTelemetry SDK instrumentation and eBPF auto‑instrumentation for Go applications, introduces the Alibaba Cloud OpenTelemetry Golang Agent that performs compile‑time automatic instrumentation, details its architecture, code examples, plugin support, and future roadmap.
The article examines why eBPF has become a core building block for cloud‑native network functions, outlines its performance, security and flexibility advantages, discusses technical challenges such as memory constraints and missing SIMD support, and presents the eNetSTL library that mitigates these issues with concrete design details and benchmark results.
This article explains how to produce Lua‑level flame graphs for OpenResty by leveraging SystemTap’s lj‑lua‑stacks tool, demonstrates the underlying data structures and call‑stack extraction, and explores a possible eBPF‑based rewrite for safer, kernel‑level tracing.
Netcap, an open‑source eBPF‑based kernel network capture tool from ByteDance STE, lets developers trace packets across the entire Linux network stack, filter with tcpdump syntax, and extend functionality with custom filters, dramatically improving the efficiency of diagnosing kernel packet loss problems.
This comprehensive course provides a deep dive into Kubernetes networking, covering core concepts, network models, policies, plugins, traffic management, security, multi‑tenant, cross‑cloud, and hybrid‑cloud designs, and offers hands‑on performance optimization techniques across more than 60 video modules.
The 2024 Netdev 0x18 conference in Santa Clara showcased six ByteDance STE presentations covering machine‑learning‑driven Nginx latency tuning, a novel zero‑copy notification, fine‑grained TCP tuning with eBPF, transparent shared‑memory communication, cross‑data‑center traffic management using AI, and asymmetric multi‑processing to cut network jitter.
This article introduces eBPF, explains its zero‑intrusion observability advantages, describes its architecture and runtime workflow, outlines development prerequisites and compilation steps, and provides concrete Go‑based examples for tracing bash commands and measuring TCP connection latency.
This article explains how to extend eBPF to make virtio‑net NIC queue metrics observable, walks through the front‑end send/receive flow, defines key queue indices, integrates the probes into the rtrace tool, and demonstrates fault detection with real‑time data.
The article provides a detailed technical overview of Linux's new extensible scheduler class SCHED_EXT, explaining its architecture, eBPF‑based customization interfaces, core data structures, queue management, scheduling points, and a central‑scheduler example, while comparing it with traditional CFS and per‑CPU run‑queues.
The Linux kernel’s extensible scheduler class sched_ext introduces a new ext_sched_class with eBPF‑driven callbacks and dispatch queues, allowing developers to plug custom scheduling policies via struct sched_ext_ops without recompiling the kernel, while integrating into the existing hierarchy and exposing trade‑offs such as central‑CPU load and community adoption challenges.
The article explains how zero‑intrusion eBPF provides full‑stack, high‑quality observability data that, when combined with large language models, enables AI‑driven agents to automate ticket handling, change impact analysis, and vulnerability triage, dramatically improving operational efficiency.
This article examines the Terway DataPath V2 mode in Alibaba Cloud Kubernetes, detailing its architecture, data‑plane forwarding paths, eBPF acceleration, and eight typical traffic scenarios across different ENI and node configurations, while providing practical command‑line examples and performance insights.
The article introduces xcap, an eBPF‑based next‑generation kernel network packet capture tool that overcomes the limitations of traditional utilities like tcpdump by providing flexible hook points, customizable filtering, and support for diverse network scenarios such as AF_XDP and DPDK, thereby dramatically improving packet‑loss debugging efficiency.
The team successfully employed eBPF dynamic tracing to obtain full Java call‑stack traces from any point in an OpenJDK 8 JVM process with microsecond‑level overhead, without requiring any JVM agents, bytecode injection, or code modifications, making it suitable for production environments.
This article walks through constructing pure‑C eBPF programs using the native libbpf library, covering kernel‑libbpf version mapping, environment setup for RPM and DEB systems, detailed Makefile analysis, embedding BPF objects via hexdump, and extending the approach to USDT and Uprobe tracing without relying on libbpf‑bootstrap.
Ubuntu kernel engineer Andrea Righi created scx_rustland, a Rust‑written Linux scheduler that runs in user space and can be hot‑plugged at runtime via eBPF, showcasing the flexibility, safety, and potential for micro‑kernel designs while allowing workload‑specific optimizations.
An Ubuntu kernel engineer built a Rust scheduler using eBPF, achieving twice the frame rate in a game while only modestly increasing compile time, sparking debate on Rust versus C for kernel components and the future of dynamic, BPF‑driven scheduling in Linux.
The article surveys the evolution of POSIX abstractions from the 1970s to the present, explains why hardware trends and modern workloads expose limitations of the CPU‑centric model, and argues that a new set of higher‑level interfaces is needed for future systems.
The article details Minsheng Bank's step‑by‑step journey from traditional network monitoring to a full‑stack, zero‑intrusion observability platform built with DeepFlow, vTap, distributed data collection, and eBPF, illustrating concrete case studies and future plans for expanding business‑level monitoring.
This article explains how the eBPF‑based ARMS monitoring solution provides non‑intrusive, language‑independent observability for cloud‑native microservices by addressing the shortcomings of traditional protocol parsers with a low‑overhead, real‑time parsing architecture.
The article forecasts rapid eBPF adoption across cloud‑native networking, mobile devices, and observability, highlights emerging eBPF marketplaces, discusses performance gains with NetKit and BIG TCP, predicts IPv6‑first Kubernetes clusters, AI‑assisted network troubleshooting, and the growing convergence of platform engineering and networking in 2024.
This article walks through deploying Apache APISIX and DeepFlow in a Kubernetes cluster, configuring eBPF‑based AutoTracing and OpenTelemetry integration, enabling Prometheus metrics, accessing logs and continuous profiling, and visualizing unified observability data via Grafana dashboards.
This article guides you through installing BCC, creating simple and complex eBPF programs with C and Python, explains eBPF architecture, source‑code organization, and demonstrates real‑world tracing examples for kernel diagnostics and performance monitoring.
Nickel is a high‑performance, XDP‑based four‑layer edge load balancer that replaces Bilibili’s non‑clustered CDN architecture with a co‑deployed control plane and data plane, using hash‑based forwarding, dynamic health‑checks, and two‑hop routing to lower cost, improve load distribution, and eliminate dedicated load‑balancer machines.
At KubeCon China 2023, experts Liu Kai and Dong Shandong presented a three‑part deep dive into Kubernetes observability challenges, demonstrating how eBPF enables comprehensive data collection across all stack layers, seamless integration, and intelligent root‑cause analysis through dimension attribution, anomaly bounding, and fault‑tree methods.
This talk explains the three major observability challenges in Kubernetes, demonstrates how eBPF enables comprehensive, low‑overhead data collection across all stack layers, and outlines a practical workflow that combines architecture awareness, application‑level metrics, and fault‑tree analysis to achieve automated root‑cause diagnosis.
On October 28 2023, the 18th China Linux Kernel Developers Conference gathered nearly 500 developers in Shenzhen, livestreamed to over 180,000 viewers, featured keynote talks on kernel scheduling, AI‑driven evolution, Rust integration, and cloud‑hardware co‑design, and offered sub‑forums on memory, virtualization, I/O, and eBPF, with all materials now publicly available.
This article examines XDP (eXpress Data Path), a Linux kernel eBPF‑based technology that pushes packet processing to the earliest point in the network interface, delivering ultra‑low latency, enhanced security, and flexible custom processing for high‑performance routing, DDoS mitigation, and cloud environments.
The article introduces OpenCloudOS’s cloud‑native initiatives—including a mixed‑workload CPU QoS scheduler, the RUE resource‑utilization enhancement, the eBPF‑based nettrace network‑diagnosis tool, and the TCase/TSuite testing platform—highlighting how these innovations improve CPU utilization, cut costs, and ensure high‑quality releases.
At the 2023 CCF ESTC conference, OPPO showcased its 64 KB dynamic large‑page technology that can increase memory‑access bandwidth up to sixteenfold and improve app startup and frame rates, while also co‑hosting a Linux‑kernel forum on scheduler, lock contention, memory defragmentation and hot‑cold page optimization, underscoring the company’s push for industry‑academic collaboration and future OS research.
Didi’s observability platform leverages non‑intrusive eBPF probes to automatically capture and validate service‑to‑service call tuples, supplement missing SDK data, achieve roughly 80 % core‑path coverage, and address verification challenges while planning future user‑space VM hooks and deeper MTL integration.
This article explains how KubeSkoop leverages eBPF to provide low‑overhead, pod‑level network monitoring and real‑time diagnostics for Kubernetes clusters, covering packet flow fundamentals, traditional troubleshooting tool limitations, the exporter’s probe architecture, daily monitoring practices, and future development plans.
DeeTune is Baidu’s eBPF‑based cloud‑native network framework that automatically builds complete service topologies, records configurable inter‑service traffic, and provides non‑intrusive metric monitoring with minimal CPU and memory overhead, enabling efficient fault localization and performance analysis across heterogeneous PaaS and container environments.
The article walks through the complete eBPF injection workflow—opening a skeleton, loading and JIT‑compiling the program with bpf_object__load_skeleton, attaching it to a kernel kprobe via perf_event_open_probe and bpf_link_create, and finally triggering the probe so the JIT‑compiled eBPF code runs inside the kernel.
The article walks through libbpf’s step‑by‑step process for opening the vfsstat.bpf.o ELF object, validating options, parsing ELF headers, collecting sections, initializing maps and programs, and preparing the eBPF program for later kernel loading and attachment.
This article explains the evolution of service mesh data planes from traditional sidecar proxies to the ambient mesh model, detailing L4/L7 split, eBPF acceleration, Waypoint proxies, CNI and Geneve tunnel configurations, and the resulting end‑to‑end traffic flow in Kubernetes clusters.
This article traces the evolution of eBPF from its BPF predecessor, explains its kernel requirements, security model, probe mechanisms, performance impact, tracing capabilities, and potential event‑loss risks, and looks ahead to its expanding role in networking and system observability.
The article describes an eBPF‑based, language‑agnostic traffic recording framework that hooks low‑level socket operations and thread identifiers to capture complete request‑response flows across Java, PHP, and Go services without modifying application code, dramatically lowering implementation and maintenance costs for cloud‑native traffic replay.
The article discusses the renewed relevance of performance engineering amid the slowdown of Moore’s Law, highlighting the Chinese edition of "Systems Performance: Enterprise and the Cloud," modern observability tools like eBPF, the "golden 60‑second" analysis, and the push toward continuous performance monitoring and expert systems.
This article traces the evolution of service mesh from its early concepts through microservice 1.0 and 2.0, analyzes the shortcomings of Envoy‑based sidecars, and explores future directions such as Go‑based data planes, WASM plugins, eBPF/VPP acceleration, QUIC transport, and on‑demand xDS delivery.
eBPF, a safe, high‑performance Linux kernel extension evolving from the 1993 Berkeley Packet Filter to modern dynamic tracing, underpins Didi’s HuaTuo platform, which consolidates bytecode management, fast data processing, stability self‑healing, and container insight to solve traffic replay, topology, security, and root‑cause analysis challenges across cloud‑native services, with plans to broaden business use and community collaboration.
KubeSkoop, an open‑source tool from Alibaba Cloud, automates Kubernetes container network diagnosis by building traffic paths, collecting eBPF and IaaS data, and pinpointing root causes for connectivity and jitter issues, supporting major CNI plugins and offering deep network monitoring with Prometheus integration.
This article reviews the fundamentals of eBPF, explains its architecture and tracing mechanisms such as USDT, uprobes, and TC hooks, provides practical code examples, discusses security aspects, and lists notable open‑source projects that leverage eBPF for performance and observability.
This article explains Linux kernel tracing tools—including kprobes, kretprobes, uprobes, tracepoints, ftrace, perf, and eBPF—detailing how probe handlers are injected, how events are recorded via TraceFS, and which technique best fits different debugging and performance‑analysis scenarios.
This article explains the concepts and mechanisms behind Linux kernel tracing tools—including ftrace, perf, kprobes, uprobes, tracepoints, ftrace, perf events, and eBPF—showing how probes are injected, how trace data is collected, and which technology to choose for different debugging and performance scenarios.
The article explains Android’s emerging eBPF support, detailing how to write, compile, load, attach, and debug BPF programs—including map handling, permission controls, perf‑event reporting, and practical debugging steps—while highlighting its current preliminary status and vast potential for kernel‑level monitoring on mobile devices.
This article examines the difficulty of achieving the 1‑5‑10 observability goal, reviews current tracing, logging, and metrics tools, introduces the open‑source Kindling project’s eBPF‑based trace‑profiling approach, and walks through several real‑world use cases that demonstrate faster root‑cause analysis in cloud‑native environments.
This article walks you through the complete process of compiling pure‑C eBPF programs using the Linux 4.18 kernel source, covering environment setup, kernel source acquisition, essential build steps, detailed make command analysis, and verification of both user‑space and kernel‑space components.
This article explains how eBPF can replace iptables for traffic redirection in Istio's ambient mesh, describing the implementation details, installation steps, performance benefits, and considerations for choosing between eBPF and traditional iptables approaches.
The article analyzes how Cilium’s eBPF‑based architecture, advanced network policies, cluster‑wide traffic control, and observability tools like Hubble solved performance, security, and scalability challenges that Flannel and kube‑proxy could not meet in production Kubernetes environments.
The interview with Kindling founder Cheng Chan explores how eBPF‑based Kindling tackles the overwhelming metrics, high expertise barrier, and lack of real‑time protocol parsing in cloud‑native observability, detailing its probe architecture, protocol analysis, and roadmap for faster, standardized root‑cause detection.
This guide walks you through installing and configuring the open‑source Odigos observability control plane on a Kubernetes cluster, showing how to automatically collect traces, metrics, and logs from applications without modifying code and how to visualize the data with Grafana.
This article introduces eBPF, explains its origins, compares it with SystemTap and DTrace, outlines its core use cases such as network monitoring, security filtering, performance analysis and virtualization, and provides step‑by‑step examples and tooling for Linux kernel tracing.
This article explains how eBPF technology provides a unified, zero‑intrusion monitoring solution for Serverless applications across any language, detailing its architecture, workflow, and the advantages it brings to cloud‑native operations such as low cost, high performance, and multi‑protocol support.
This article explains how eBPF extends kernel functionality to enable secure, high‑performance networking, observability, and programmable workloads in cloud‑native environments, detailing its architecture, use cases, market adoption, commercialization models, and the challenges and advantages that make it comparable to JavaScript for the kernel.
This article explains what eBPF is, why it matters for cloud‑native architectures, its key components and use‑cases in networking, observability and security, and explores current market momentum and commercialization models for leveraging eBPF in modern infrastructure.
nettrace is an eBPF‑powered command‑line utility that traces a packet’s full kernel lifecycle, diagnoses network faults with a built‑in knowledge base, monitors anomalies and skb drops, supports NAT, GRE, IPVS and netfilter hooks, and replaces legacy tools like tcpdump and droptrace in cloud‑native Linux environments.
Bilibili’s video CDN replaced its traditional TCP‑based gateway with a QUIC/HTTP‑3 gateway and, to curb the extra CPU load caused by complex UDP handling, adopted AF_XDP kernel‑bypass sockets that redirect packets via XDP, cutting CPU usage by about half, raising peak bandwidth to roughly 9 Gbps and improving per‑bandwidth efficiency by up to 30 %.
This article provides a comprehensive overview of eBPF, explaining its origins, core concepts, comparison with SystemTap and DTrace, common use cases such as network monitoring, security filtering, and performance analysis, and includes step‑by‑step Python examples with BCC for tracing and latency measurement.
This article introduces eBPF, explains its origins and how it extends BPF for kernel‑level observability, compares it with SystemTap and DTrace, outlines common use cases, details its loading‑compile‑execute workflow, and provides step‑by‑step Python/BCC examples with installation instructions and advanced latency measurement code.
This article explains what eBPF (extended Berkeley Packet Filter) is, compares it with related tracing tools, describes its core mechanisms and common applications such as network monitoring, security filtering and performance analysis, and provides step‑by‑step Python examples with installation instructions and further reading resources.
eBPF lets developers run custom, safe code inside the Linux kernel, enabling dynamic networking, load‑balancing, security policies, and observability without restarting services, and its integration with Kubernetes through tools like Cilium and XDP is revolutionizing cloud‑native deployments.
The article details Zhengcaiyun's government procurement cloud platform, its large‑scale architecture, migration to the domestically‑adapted Dragonfly operating system, integrated cloud‑native operations, observability built on OpenTelemetry, and ongoing efforts to enhance security, performance, and ecosystem collaboration.
The article details Zhengcaiyun's government procurement cloud platform, its large‑scale deployment architecture built on the Longxi OS, covering cloud‑native design, domestic adaptation, observability, and operational practices that enable high‑performance, secure, and scalable public procurement services.
This guide explains how to enhance Kube‑OVN with Cilium’s eBPF‑based networking and security features by using CNI chaining, covering prerequisites, configuration changes, Helm deployment steps, verification commands, and useful reference links for a complete cloud‑native networking solution.
Using eBPF to bypass traditional bridge, netfilter, and routing steps, this article demonstrates how container network packet forwarding can be accelerated, reducing receive and transmit latency by around 40‑82%, with detailed perf‑ftrace analysis, code examples, and performance comparisons of three forwarding modes.
This article explains how the Intel istio‑tcpip‑bypass plugin leverages eBPF to bypass the host TCP/IP stack for intra‑node pod communication, provides environment setup, step‑by‑step deployment commands, and shows benchmark results that demonstrate 40‑80% latency reduction and throughput improvement.
In this technical session, experts from Lingque Cloud and Yunshan Network discuss emerging cloud‑native networking trends through Kube‑OVN, demonstrate DeepFlow's full‑stack observability in Kube‑OVN environments, and answer a wide range of practical Q&A covering IP stability, underlay challenges, CNI support, and performance tuning.
This article explains the evolution, principles, use cases, workflow, and limitations of eBPF, showing how programmable kernel extensions enable advanced observability, networking, and security capabilities across Linux systems and cloud‑native environments.
This article presents DeepFlow, an open‑source, highly automated observability platform that uses eBPF to provide zero‑code AutoMetrics and AutoTracing, integrates with Prometheus, OpenTelemetry and SkyWalking, and enables SRE, DevOps and NewOps teams to build full‑stack metrics and blind‑spot‑free tracing for cloud‑native applications.
This article explores modern service governance in the microservice era, comparing traditional sidecar‑based Service Mesh solutions like Istio with emerging eBPF‑driven meshes and RSocket Broker architectures, highlighting their design, performance, operational, and security trade‑offs.
This article examines how F6 tackled growing stability demands by evolving from traditional ELK‑based logging to a cloud‑native observability stack that combines Grafana, Prometheus, eBPF, OpenTelemetry, and ARMS, illustrating practical steps, challenges, and lessons learned for modern microservice environments.
pwru, Cilium’s eBPF‑based packet tracing utility, offers fine‑grained network diagnostics; this guide covers kernel requirements, installation steps, command‑line options, real‑world iptables drop detection examples, and an in‑depth look at its eBPF map configuration and perf‑event output mechanism.
This comprehensive guide explains Linux kernel performance profiling—both on‑CPU and off‑CPU—by stressing the need to target the critical 3 % of code, covering throughput, latency and power metrics, scalability laws, flame‑graph visualizations, perf and eBPF tools, lock‑contention analysis, and further reading recommendations.
This article introduces pwru, Cilium’s eBPF‑based network packet tracing utility, covering installation prerequisites, command‑line options, real‑world debugging scenarios, and the underlying implementation that leverages kprobes, eBPF maps, and perf events to filter and display packet data.
eBPF is a kernel‑level sandbox technology that enables safe, high‑performance, programmable instrumentation for networking, security, and observability, and this article answers seven key questions covering its definition, applications, origins, usage steps, implementation details, best practices, and current ecosystem.
