A Beginner's Guide to eBPF Programming for Networking
summary
Live-coding shows how eBPF programs actually attach and behave: bcc framework compiles C eBPF and attaches a kprobe to tcp_v4_connect for tracing, a socket filter that copies TCP but not ICMP to user space, XDP on a given interface that sees ping at NIC arrival, and tc ingress that first drops packets then converts a ping into a reply by swapping MAC/IP and cloning the skb. perf tracing demonstrates bypassing parts of the kernel stack and the talk connects these techniques to faster Kubernetes CNI packet delivery.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 4:30K Probes
- 11:50xdp
- 16:10traffic control example
- 19:30ping response example
- 24:20eBPF in Kubernetes
- 25:55Advantages of eBPF
- 27:25Conclusion
related talks
32meBPF: BPF kernel infrastructure
32mDemystifying eBPF - eBPF Firewall from scratch
32mOverview of the BPF networking hooks and user experience in Meta
05mLightning Talk: Back to the Future with eBPF
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
21mCilium Beyond Linux: Extending eBPF to Windows...
37mEfficient and Flexible Virtual Machine Networking Through eBPF
34mWhat's new in the BPF world?