The Linux netfilter module enables user-space applications to register the processing rules applied to the packets by the Linux kernel network stack. This enables efficient network forwarding and…
Archive link: https://archive.ph/c8Dbc
We're proud to announce the general availability of Grafana Beyla, the open source eBPF auto-instrumentation tool that helps you easily get started with application observability.
GitHub - gojue/ecapture: Capture SSL/TLS text content without a CA certificate using eBPF. This tool is compatible with Linux/Android x86_64/Aarch64.
Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64. - gojue/ecapture
eBPF Summit 2023 Schedule
Explore the talks of the eBPF Summit, a virtual event for all things within the Open Source eBPF ecosystem
Anyone plans to attend?
With so many Cilium labs to choose from, follow these role-based learning tracks based to help you on your journey to learn Cilium?
Learning tracks to explore Cilium
Register now for the eBPF Summit 2023, Sep 13, 2023, a free virtual event for DevOps, SRE, SecOps, and developers.
virtual event
Catch Performance Regressions in eBPF with Rust: Intro
Series of articles on using Rust with eBPF
This article shares insights into learning eBPF as a new cloud-native technology which aims to improve Observability and Security workflows. Learn how to practice using the tools, and dive into your own development. Iterate on your knowledge step-by-step, and follow-up with more advanced use cases l...
Very nice article to introduce to development using eBPF
Building an XDP eBPF Program with C and Golang: A Step-by-Step Guide is a comprehensive tutorial that walks readers through the process of building an XDP (eXpress Data Path) eBPF (extended Berkeley Packet Filter) program using C and Golang. The article provides a clear overview of XDP and eBPF, hig...
Very well written guide
Performance tracing is an essential process that involves the collection, analysis and interpretation of system data. The primary objective of performance tracing is to identify bottlenecks, diagnose problems and optimize performance to ensure that systems operate within their limits.
Learn how XDP allows you to build network packet-processing programs with extremely high performance.
Challenges with the traditional network stack Packet flow in the kernel with XDP The mechanics of XDP programs How to build a simple XDP program Conclusion References
For a while, I’ve been following stuff around eBPF, and it is very promising. What I just wrote is an understatement. At first glance, eBPF is bringing many new possibilities to our toolbox. You can start with performance profiling, tracing, security, networking, etc. But let’s start from the beginn...
Introduced me to Lima (Lima: Linux virtual machines (on macOS, in most cases))
eBPF - Why eBPF for All Means People Don’t Need to Care about eBPF
On the one hand, there are more eBPF-based products and companies than ever before, lighting operations and platform teams abuzz. On the other hand, if you ask the average developer, the term “eBPF” feels foreign and irrelevant to them.
eBPF is a power horse you don't really need to care about (unless you want to)
GitHub - keyval-dev/odigos: Instant distributed traces without code changes. 🚀 Boost existing monitoring tools with higher-quality data
Distributed tracing without code changes. 🚀 Instantly monitor any application using OpenTelemetry and eBPF - odigos-io/odigos
Built with eBPF & OpenTelemetry - Applications are instrumented using well-known, battle-tested open source observability technologies
Return to Sender - Detecting Kernel Exploits with eBPF
https://github.com/Gui774ume/krie
KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker will eventually be able to bypass it. That being said, the goal of the project is to make attackers' lives harder and ultimately prevent out-of-the-box exploits from working on a vulnerable kernel.
Founded in 2021 by Shahar Azulay and Yechezkel Rabinovich, Groundcover is one of the first observability platforms based on eBPF.
Another kubernetes observability tool ;)
