EBPF

Overview eBPF (Extended Berkeley Packet Filter) is one of the most revolutionary technologies in the Linux kernel over the past decade. It allows developers to safely and efficiently run custom programs in kernel space — without modifying kernel source code or loading kernel modules. From network packet filtering to syscall tracing, from performance analysis to security auditing, eBPF has become the cornerstone of modern observability and network data planes. This article starts with the fundamental principles of eBPF, progressively covering development environment setup, program type selection, a practical comparison between BCC and libbpf+CO-RE, and finally a complete production-grade eBPF tool development workflow....

eBPF: The Kernel Programmability Revolution Traditional performance analysis tools fall into two categories: “overview” tools like top, vmstat, and iostat that tell you what’s happening at the system level but lack detail; and “tracing” tools like strace and gdb that show detail but incur massive overhead, making them impractical for production. eBPF (Extended Berkeley Packet Filter) changed everything. It allows you to run sandboxed programs in the kernel without modifying kernel source code or loading kernel modules....