Tracing the Linux networking stack with Retis
summary
retis is a Rust tool that traces individual packets end to end across kernel and user space using eBPF probes and modular collectors, with YAML profiles to enable sets of probes. tcpdump-style BPF filters are translated into eBPF and applied in-kernel, events are emitted as JSON and can be shorted into per-packet timelines. demos show it finding an unexpected netfilter drop after the packet’s source IP mutates and reconstructing Open vSwitch flows that go to user space and back into the kernel (live demo has some glitches but recorded runs work).
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 0:36The networking problem space
- 3:20Introducing Retis
- 4:21Collectors and probes
- 7:12Advanced collectors and features
- 9:22Profiles and filtering
- 11:14Live demonstrations
- 25:24Future plans and conclusion
- 26:27Q&A session
related talks
27mBeyond printf & tcpdump: Debugging Kubernetes Networking with eBPF
46mTracing the Linux kernel with eBPF and Rust
44mAdvanced Linux Kernel Networking Monitoring
43meBPF Superpowers for SRE
30mA Beginner's Guide to eBPF Programming for Networking
35mFollowing a packet journey through the networking stack in OpenShift
38mLinux Kernel Tracing Using eBPF
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications