BestHub
Sign in
Tagged articles

eBPF

254 articles · Page 3 of 3
Meituan Technology Team
Meituan Technology Team
Apr 7, 2022 · Information Security

Malicious Use of eBPF in Cloud‑Native Environments: Threats, Detection, and Defense

While eBPF powers modern cloud‑native networking and observability, attackers can exploit its kernel hooks to create stealthy rootkits that manipulate packets, rewrite files, and persist across reboots, so security teams must harden privileges, monitor BPF syscalls, audit loaded programs, and employ signature verification and LSM controls to detect and mitigate these threats.

DetectionRootkitcloud-native security
0 likes · 30 min read
Malicious Use of eBPF in Cloud‑Native Environments: Threats, Detection, and Defense
Cloud Native Technology Community
Cloud Native Technology Community
Mar 29, 2022 · Cloud Native

Can eBPF Replace Netfilter? Boosting Kubernetes Network Performance

This article examines the performance limitations of Kubernetes pod, service, and network‑policy layers built on the kernel Netfilter framework, explores eBPF‑based alternatives such as tc‑ebpf and Cilium, describes a Terway‑with‑eBPF implementation, and presents benchmark results showing significant latency and scalability improvements.

Network PerformanceTerwaycni
0 likes · 13 min read
Can eBPF Replace Netfilter? Boosting Kubernetes Network Performance
Cloud Native Technology Community
Cloud Native Technology Community
Mar 22, 2022 · Cloud Native

Evaluating eBPF’s Role in Service Mesh Data Plane: Architecture Trade‑offs

This article examines how eBPF can enhance service‑mesh data planes, compares four deployment models—including sidecar, node‑shared, service‑account‑shared, and micro‑proxy architectures—and evaluates each model’s memory, isolation, security, and upgrade trade‑offs while emphasizing Envoy’s continued L7 responsibilities.

Cloud NativeData PlaneEnvoy
0 likes · 11 min read
Evaluating eBPF’s Role in Service Mesh Data Plane: Architecture Trade‑offs
Efficient Ops
Efficient Ops
Mar 15, 2022 · Cloud Native

How eBPF Powers Seamless Observability in Cloud‑Native Kubernetes Environments

This article explains why the rise of Kubernetes as a cloud‑native standard brings new observability challenges, outlines how eBPF enables non‑intrusive, multi‑language, multi‑protocol data collection, and describes a comprehensive monitoring stack—including golden metrics, service topology, tracing, alerts, and network diagnostics—to achieve end‑to‑end visibility in complex Kubernetes deployments.

Cloud NativeKubernetesMonitoring
0 likes · 22 min read
How eBPF Powers Seamless Observability in Cloud‑Native Kubernetes Environments
IT Services Circle
IT Services Circle
Mar 14, 2022 · Fundamentals

Understanding Localhost (127.0.0.1) Network I/O in the Linux Kernel

This article explains in detail how Linux handles local network I/O for 127.0.0.1, comparing it with cross‑machine communication, describing the routing, device subsystem, driver code, and soft‑interrupt processing, and concluding with performance considerations and a discussion on eBPF acceleration.

LinuxNetworkingTCP/IP
0 likes · 16 min read
Understanding Localhost (127.0.0.1) Network I/O in the Linux Kernel
Tencent Cloud Middleware
Tencent Cloud Middleware
Mar 10, 2022 · Cloud Native

How eBPF Can Replace iptables to Boost Service Mesh Performance

This article explains how replacing the traditional iptables‑based sidecar traffic‑hijacking in Istio with eBPF programs and sockmap can cut CPU usage, increase QPS and lower latency, while detailing the implementation, architecture, and performance results on Kubernetes.

Cloud NativeKuberneteseBPF
0 likes · 13 min read
How eBPF Can Replace iptables to Boost Service Mesh Performance
Ops Development Stories
Ops Development Stories
Mar 4, 2022 · Cloud Native

Why Observability Is the ‘Force’ Empowering Modern IT Systems

This talk explains why observability is essential for cloud‑native IT systems, covering its core value of empowerment, various definitions, evaluation criteria such as zero‑intrusion, multidimensionality and real‑time response, and practical building approaches using SaaS, open‑source and integration, illustrated with numerous industry case studies.

MonitoringSaaSeBPF
0 likes · 24 min read
Why Observability Is the ‘Force’ Empowering Modern IT Systems
Efficient Ops
Efficient Ops
Feb 14, 2022 · Cloud Native

How Merbridge Uses eBPF to Accelerate Istio Traffic: A Deep Dive

Merbridge, an open‑source project, replaces Istio’s iptables‑based traffic handling with eBPF sockops and redir, dramatically reducing kernel processing steps, improving latency and QPS, and providing seamless integration without modifying existing Istio configurations.

IstioNetwork AccelerationeBPF
0 likes · 12 min read
How Merbridge Uses eBPF to Accelerate Istio Traffic: A Deep Dive
OPPO Kernel Craftsman
OPPO Kernel Craftsman
Feb 11, 2022 · Operations

Overview and Implementation of eBPF for Android Network Statistics and Control

The article explains how Android’s shift to Linux kernel 4.x/5.x introduced the eBPF framework, detailing its advantages over iptables, the programming model with helper macros and maps, and its implementation in netd and HAL to collect network statistics, enforce traffic control, and support power‑saving Doze policies.

AndroidBPFSystem Programming
0 likes · 8 min read
Overview and Implementation of eBPF for Android Network Statistics and Control
Liangxu Linux
Liangxu Linux
Jan 23, 2022 · Operations

Master Linux Tracing with bpftrace: Install, Run, and Explore Built‑in Tools

bpftrace is a Linux eBPF‑based tracing tool that compiles scripts to BPF bytecode, offering kernel and user‑space probes; the guide covers its purpose, installation on major distros and Docker, and demonstrates built‑in example scripts for command logging, I/O latency, disk size, CPU usage, and TCP connection tracing.

Linux tracingbpftraceeBPF
0 likes · 7 min read
Master Linux Tracing with bpftrace: Install, Run, and Explore Built‑in Tools
Rare Earth Juejin Tech Community
Rare Earth Juejin Tech Community
Jan 14, 2022 · Cloud Native

Service Mesh in 2021: Progress, Challenges, and Ecosystem Development

During 2021, the service‑mesh ecosystem—centered on Istio—matured with performance optimizations, protocol extensions, diverse deployment models, eBPF integration, and a growing community of tutorials, conferences, and open‑source projects, solidifying its role as essential cloud‑native networking infrastructure.

IstioeBPFperformance optimization
0 likes · 11 min read
Service Mesh in 2021: Progress, Challenges, and Ecosystem Development
Baidu Geek Talk
Baidu Geek Talk
Jan 5, 2022 · Cloud Native

Baidu Cloud‑Native Mixed Workload (Offline Co‑location) Technology Overview

Baidu’s mixed‑workload approach co‑locates offline batch jobs with latency‑sensitive online services on shared nodes, using a dynamic resource view, priority‑based scheduling, cpuset/NUMA isolation, eBPF policies, and predictive profiling, boosting CPU utilization above 40 % and saving billions of RMB in total cost of ownership.

KubernetesMixed Workloadcloud-native
0 likes · 17 min read
Baidu Cloud‑Native Mixed Workload (Offline Co‑location) Technology Overview
Baidu Tech Salon
Baidu Tech Salon
Dec 31, 2021 · Industry Insights

How Baidu Boosted CPU Utilization by Up to 80% with Offline Mixed‑Tenant Scheduling

This article analyzes Baidu's offline mixed‑tenant technology that combines online and offline workloads on the same physical servers, detailing the resource‑usage problems, dynamic resource views, priority schemes, isolation mechanisms, high‑performance scheduling, and future directions for cloud‑native clusters.

Cloud NativeKubernetescpu-utilization
0 likes · 18 min read
How Baidu Boosted CPU Utilization by Up to 80% with Offline Mixed‑Tenant Scheduling
Qingyun Technology Community
Qingyun Technology Community
Dec 17, 2021 · Cloud Native

What’s New in Cilium 1.11? Service Mesh, BGP, XDP and More

Cilium 1.11 introduces a beta Service Mesh, Kubernetes Ingress support, OpenTelemetry integration, topology‑aware load balancing, BGP pod‑CIDR announcements, managed IPv4/IPv6 neighbor discovery, XDP multi‑device acceleration, graceful termination, scalable ID spaces, endpoint slices and several feature enhancements and deprecations.

BGPKubernetescilium
0 likes · 31 min read
What’s New in Cilium 1.11? Service Mesh, BGP, XDP and More
DeWu Technology
DeWu Technology
Dec 14, 2021 · Operations

Online Service Alarm Handling and Performance Profiling in Go

The article outlines a systematic SOP‑driven approach for diagnosing online service alarms and performance issues in Go, detailing a toolbox that includes pprof, trace, goroutine visualizers, perf and eBPF, and recommends application‑level optimizations, system tuning, and continuous profiling to accelerate root‑cause identification and reduce incident frequency.

GoOnline ServiceSOP
0 likes · 11 min read
Online Service Alarm Handling and Performance Profiling in Go
Open Source Linux
Open Source Linux
Dec 12, 2021 · Cloud Native

Unlocking eBPF: From Packet Filtering to Cloud‑Native Observability

This article explores the evolution of BPF from its origins as a packet‑filtering mechanism to the modern eBPF engine, detailing its architecture, security and performance benefits, core features such as hooks, maps and helper functions, and real‑world cloud‑native use cases like Cilium, Falco and kubectl‑trace.

Cloud NativeLinux kernelNetworking
0 likes · 26 min read
Unlocking eBPF: From Packet Filtering to Cloud‑Native Observability
Qingyun Technology Community
Qingyun Technology Community
Nov 24, 2021 · Operations

How eBPF Toolchains Simplify Kernel Tracing from BCC to BPFtrace

This article walks through the high‑level components of eBPF programs—backend, loader, frontend, and data structures—showing how the original sock_example.c is split into separate files, how LLVM compiles restricted C to ELF, and how projects like BCC, BPFtrace, and IOVisor automate development, deployment, and cloud‑native observability while highlighting their trade‑offs for embedded environments.

BCCCloud NativeLinux
0 likes · 15 min read
How eBPF Toolchains Simplify Kernel Tracing from BCC to BPFtrace
Cloud Native Technology Community
Cloud Native Technology Community
Nov 23, 2021 · Fundamentals

Reading Notes on OSDI20 Best Paper hXDP: Efficient Software Packet Processing on FPGA NICs

This article reviews the OSDI20 best paper on hXDP, explaining why combining XDP with FPGA NICs can alleviate CPU bottlenecks, describing the challenges of eBPF offload to low‑frequency FPGA, and summarizing the custom instruction‑set optimizations and test results that achieve comparable performance to multi‑GHz CPUs.

FPGAInstruction Set OptimizationNetwork Acceleration
0 likes · 8 min read
Reading Notes on OSDI20 Best Paper hXDP: Efficient Software Packet Processing on FPGA NICs
Programmer DD
Programmer DD
Oct 12, 2021 · Cloud Native

How Is Cloud‑Native Transforming Linux OSes? Inside Anolis OS and eBPF

The article explores recent shifts in the operating‑system landscape—including the CentOS 8 end‑of‑life, the rise of dual‑kernel Anolis OS, and the surge of eBPF—highlighting how cloud‑native demands are reshaping Linux development, security, and community governance.

Anolis OSLinuxOpen Source
0 likes · 13 min read
How Is Cloud‑Native Transforming Linux OSes? Inside Anolis OS and eBPF
MaGe Linux Operations
MaGe Linux Operations
Sep 29, 2021 · Cloud Native

Why Cilium Is the Coolest Kubernetes CNI Plugin and How to Deploy It

This article introduces Cilium, the eBPF‑based Kubernetes CNI that replaces kube‑proxy, explains its security and scalability advantages over traditional iptables, and provides step‑by‑step guidance for deploying Cilium, testing its connectivity, and using Hubble for deep network visualization integrated with Grafana and Prometheus.

HubbleKubernetescilium
0 likes · 17 min read
Why Cilium Is the Coolest Kubernetes CNI Plugin and How to Deploy It
21CTO
21CTO
Aug 13, 2021 · Information Security

New Chinese Car Data Rules & eBPF Advances: Impact on Security and Linux Graphics

A roundup of recent developments—from China's strict regulations on connected‑vehicle data storage and mandatory cybersecurity officers, to Baidu and ByteDance's massive campus hiring drives, Alibaba's leadership reshuffle, Lenovo's earnings surge, the formation of the eBPF Foundation, and Linux 5.15's added support for Qualcomm Adreno GPUs—highlights how policy, talent, and open‑source innovations are shaping the tech landscape.

ChinaRecruitmentVehicle Data Security
0 likes · 9 min read
New Chinese Car Data Rules & eBPF Advances: Impact on Security and Linux Graphics
Open Source Linux
Open Source Linux
Aug 10, 2021 · Fundamentals

Why eBPF is Revolutionizing High‑Performance Networking for Enterprises

This article explains how eBPF evolved from classic packet filtering to a powerful, programmable kernel virtual machine that enables high‑performance networking, hardware offload, and flexible security, making it increasingly vital for operators, system administrators, and enterprise solution providers.

Linux kernelNetworkingSmartNIC
0 likes · 11 min read
Why eBPF is Revolutionizing High‑Performance Networking for Enterprises
Efficient Ops
Efficient Ops
Aug 1, 2021 · Operations

Unlocking Linux Performance: A Practical Guide to eBPF and BPF Maps

This article introduces the fundamentals of BPF and its extended version eBPF, explains their kernel‑resident virtual machine architecture, demonstrates simple packet‑filtering examples, outlines the eBPF program lifecycle, describes key BPF system‑call commands, and surveys the various eBPF map types used for efficient data handling in Linux.

BPFLinux kernelSystem Tracing
0 likes · 9 min read
Unlocking Linux Performance: A Practical Guide to eBPF and BPF Maps
Refining Core Development Skills
Refining Core Development Skills
May 27, 2021 · Fundamentals

Deep Dive into Linux Localhost Network I/O: Kernel-Level Packet Transmission and Reception on 127.0.0.1

This article provides a comprehensive analysis of the Linux kernel's handling of localhost network I/O, detailing how packets destined for 127.0.0.1 bypass physical network interfaces, traverse the routing table, and utilize the loopback virtual device and soft interrupts for efficient intra-machine communication.

Kernel RoutingLinux kernelLoopback Interface
0 likes · 12 min read
Deep Dive into Linux Localhost Network I/O: Kernel-Level Packet Transmission and Reception on 127.0.0.1
Cloud Native Technology Community
Cloud Native Technology Community
May 14, 2021 · Cloud Native

What’s Next for Kube-OVN? Roadmap, Multi‑Cloud Networking & eBPF Innovations

The 2021 Container Network Technology Conference celebrated Kube-OVN’s anniversary, showcasing its mature multi‑tenant, cross‑cluster, and hardware‑accelerated networking features, outlining a roadmap focused on performance, eBPF‑based security and monitoring, and highlighting real‑world deployments with partners such as Intel, F5, banks and telecom operators.

Cloud NativeContainer NetworkingKube-OVN
0 likes · 10 min read
What’s Next for Kube-OVN? Roadmap, Multi‑Cloud Networking & eBPF Innovations
UCloud Tech
UCloud Tech
Apr 1, 2021 · Cloud Native

How Serverless Containers Achieve Service Discovery Without kube-proxy Using eBPF

This article explains how UCloud's Serverless container product Cube integrates Virtual Kubelet with Kubernetes, why kube-proxy is unsuitable for lightweight serverless VMs, and how an eBPF‑based Rust proxy (cproxy) provides efficient service discovery and superior performance across different service scales.

Cloud NativeKubernetescproxy
0 likes · 9 min read
How Serverless Containers Achieve Service Discovery Without kube-proxy Using eBPF
Efficient Ops
Efficient Ops
Mar 3, 2021 · Information Security

How to Efficiently Audit Linux System Operations Without Overloading Logs

This article explains why detailed system operation logs are essential for security audits and troubleshooting, outlines filtering guidelines to avoid noisy data, and compares five Linux auditing methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their strengths, limitations, and practical configuration examples.

LinuxSystem Securityaudit
0 likes · 13 min read
How to Efficiently Audit Linux System Operations Without Overloading Logs
OPPO Kernel Craftsman
OPPO Kernel Craftsman
Jan 8, 2021 · Operations

Understanding eBPF and Its Use on Android for System Call Counting

The article explains eBPF’s evolution from packet filtering to a C‑compiled, sandboxed kernel framework, describes its core concepts of bytecode, JIT, and maps, and walks through building, loading, and using an Android eBPF program that counts system calls per PID via tracepoint hooks.

AndroidBPFLinux kernel
0 likes · 9 min read
Understanding eBPF and Its Use on Android for System Call Counting
Liangxu Linux
Liangxu Linux
Jan 2, 2021 · Operations

How to Effectively Audit Linux System Operations and Cut Down Noise

This article explains why detailed Linux system operation auditing is essential for security and troubleshooting, outlines practical filtering rules to avoid redundant or sensitive logs, and compares five auditing approaches—history, custom bash, snoopy, auditd, and eBPF—detailing their strengths, limitations, and configuration examples.

LinuxauditdeBPF
0 likes · 13 min read
How to Effectively Audit Linux System Operations and Cut Down Noise
Open Source Linux
Open Source Linux
Dec 28, 2020 · Information Security

Effective Linux System Auditing: Methods, Filters & Best Practices

Auditing Linux system operations is essential for security and troubleshooting, but excessive logs can overwhelm analysis; this guide outlines common filtering rules and compares five recording methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their advantages, limitations, and practical configuration examples.

LinuxauditdeBPF
0 likes · 13 min read
Effective Linux System Auditing: Methods, Filters & Best Practices
Cloud Native Technology Community
Cloud Native Technology Community
Dec 21, 2020 · Cloud Native

Kubernetes Service Load Balancing at Scale with BPF and XDP

This article explains Kubernetes' core networking model, details the various Service types (PodIP, HostPort, NodePort, ExternalIP, LoadBalancer, ClusterIP), describes Cilium's eBPF/XDP implementation for high‑performance load balancing, and presents performance benchmarks and recent BPF kernel extensions.

BPFKubernetesXDP
0 likes · 19 min read
Kubernetes Service Load Balancing at Scale with BPF and XDP
MaGe Linux Operations
MaGe Linux Operations
Dec 11, 2020 · Operations

Efficient Linux System Auditing: Tools, Filters, and Best Practices

Auditing Linux system operations can be streamlined by applying filtering rules to exclude noisy cron and daemon logs, avoiding sensitive command exposure, and choosing appropriate recording methods—such as history, custom bash, snoopy, auditd, or eBPF—each with distinct advantages, limitations, and configuration examples.

auditeBPFsecurity
0 likes · 13 min read
Efficient Linux System Auditing: Tools, Filters, and Best Practices
Efficient Ops
Efficient Ops
Nov 19, 2020 · Information Security

How to Efficiently Audit Linux System Operations: Tools, Tips, and Filtering Rules

This article explains why detailed system operation logs are essential for security audits and troubleshooting, outlines practical filtering guidelines, and compares five Linux auditing methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their strengths, limitations, and usage examples.

Linux auditingauditdeBPF
0 likes · 13 min read
How to Efficiently Audit Linux System Operations: Tools, Tips, and Filtering Rules
Ctrip Technology
Ctrip Technology
Nov 19, 2020 · Cloud Native

Deploying Cilium with BGP for Cloud‑Native Networking and Security at Ctrip

This article describes Ctrip's adoption of Cilium with BGP to build a high‑performance, eBPF‑based cloud‑native network, covering the evolution from Neutron+OVS, the BGP peering model, traffic forwarding paths, L4 load‑balancing, security policy implementation, and multi‑cluster integration using ClusterMesh.

BGPCloud Native NetworkingKubernetes
0 likes · 14 min read
Deploying Cilium with BGP for Cloud‑Native Networking and Security at Ctrip
Xueersi Online School Tech Team
Xueersi Online School Tech Team
Aug 28, 2020 · Cloud Native

Understanding Cloud Native: Service Mesh, Chaos Engineering, and User‑Space Container Networking with eBPF/XDP

This article explains the fundamentals of cloud native computing, introduces service mesh architectures such as Istio and Envoy, explores chaos engineering with Chaos Mesh, and details how eBPF/XDP‑based user‑space container networking can accelerate data‑plane performance in modern microservice environments.

Chaos EngineeringCloud NativeEnvoy
0 likes · 12 min read
Understanding Cloud Native: Service Mesh, Chaos Engineering, and User‑Space Container Networking with eBPF/XDP
Xueersi Online School Tech Team
Xueersi Online School Tech Team
Aug 7, 2020 · Operations

Designing High‑Performance Software L4 Load Balancers: Insights from LVS, Google Maglev, and Facebook Katran

This article examines the limitations of traditional L4 load balancers like LVS and explains how modern software solutions—leveraging DPDK, VPP, XDP/eBPF, and consistent‑hash algorithms such as Google Maglev and Facebook Katran—can achieve high‑throughput, scalable, and highly available L4 load balancing in data‑center environments.

DPDKL4Load Balancing
0 likes · 17 min read
Designing High‑Performance Software L4 Load Balancers: Insights from LVS, Google Maglev, and Facebook Katran
Cloud Native Technology Community
Cloud Native Technology Community
Jul 1, 2020 · Cloud Native

Boosting Kubernetes Service Performance: Inside Tencent’s IPVS‑BPF Optimization

This article examines the limitations of traditional Kubernetes Service implementations, introduces Tencent TKE’s IPVS‑BPF mode that bypasses nf_conntrack using eBPF for SNAT, details its design and implementation steps, and presents extensive performance measurements showing significant latency and throughput improvements.

Cloud NativeIPVSKubernetes
0 likes · 12 min read
Boosting Kubernetes Service Performance: Inside Tencent’s IPVS‑BPF Optimization
Alibaba Cloud Native
Alibaba Cloud Native
Apr 16, 2020 · Cloud Native

How Alibaba Cloud Designs High‑Performance Cloud‑Native Container Networks with Terway

This article reviews the SIG Cloud‑Provider‑Alibaba webinar, explains Kubernetes container networking fundamentals, details Alibaba Cloud's high‑performance CNI implementation using Terway with exclusive and shared ENI modes, and shows how eBPF, AutoPath DNS and resource‑pooling improve scalability and latency.

Cloud NativeKubernetesNetwork Performance
0 likes · 19 min read
How Alibaba Cloud Designs High‑Performance Cloud‑Native Container Networks with Terway