Beyond printf & tcpdump: Debugging Kubernetes Networking with eBPF
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 15:25· Room 408 AB + Online·
summary
An open source eBPF debugger called peru attaches kprobes to dozens of kernel packet‑processing functions (discovered via btf), loads programs via a Go agent, and pushes filters into BPF maps so callbacks only report matching traffic. It prints skb fields and a function‑level trace, exposing concrete failures: multi‑homed source IPs causing asymmetric routing, MTU fragmentation drops, and reverse‑path‑filter rejections. The tool works across kernel versions and reliably pinpoints where packets are dropped.
AI-written summary · about
chapters (11)
- 0:00Intro
- 3:27Traditional Debugging
- 5:54New Debugging Approach
- 6:49What is eBPF
- 7:47eBPF Program
- 11:33eBPF Information
- 13:40Wishlist
- 14:30Peru
- 17:22Real world examples
- 20:25tcpdump output
- 24:59peru highlights
related talks
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
38mLinux Kernel Tracing Using eBPF
42mMonitoring Kubernetes Traffic with eBPF
25mKernel tracing with BPF
24mDebuggers and eBPF: Bringing Debugging to Production
42mCommunity Driven Breakout Session: eBPF and Auto-Instrumentation
30mObservability in Kubernetes: Unlocking the Power of eBPF