What is eBPF?

eBPF (extended Berkeley Packet Filter) is an in-kernel “virtual machine” that lets you run programs in the Linux kernel—powering tracing, networking, and security without kernel recompiles.

---

🔗 Useful Links

• “What is eBPF?” on eBPF.io

  High-level overview of the eBPF “VM”, its use cases, and ecosystem.

• Linux kernel BPF documentation

  Definitive in-kernel reference for helpers, program types, verifier rules, maps.

---

🗺️ eBPFChirp Learning Path

Pick Your Toolchain

How to choose the right eBPF language (C, Rust, Go), and library (libbpf, cilium/ebpf, Aya…), before you start hacking.

Go, C, Rust, and More: Picking the Right eBPF Application Stack

Build Your First Program: eBPF Process Monitor

Step-by-step tutorial that captures execve system calls, and streams observed event data to user space—your “Hello, world” for eBPF.

Building a Real-Time Process Monitor with eBPF and Go

Observability Advanced Use Cases

• Real-Time Encrypted Traffic Observability — Monitor SSL/TLS flows in real time without touching a line of application code.

What Insights Can eBPF Provide into Real-Time SSL/TLS Encrypted Traffic and How? [Sponsored]

• PostgreSQL Traffic Observability — tap into PostgreSQL read/write system calls to stream and classify queries in real time.

Can eBPF Provide Real-Time PostgreSQL Insights Without Degrading Performance?

• Redis Traffic Observability — tap into Redis read/write system calls to parse RESP commands and flag anomalous patterns in real time.

Can eBPF Detect Anomalous Redis Message Patterns Before They Become Problems? [Sponsored]

Networking Advanced Use Cases

• Beyond “1 Port <=> 1 Socket” – eBPF’s sk_lookup hook breaks the “one-socket, one-port” rule by letting the kernel reroute new connections to any socket you choose.

Are We Really Stuck with One Socket, One Port?

• Transparent Proxying – service-mesh-style traffic steering with zero sidecars.

Transparent Proxy Implementation using eBPF and Go

• Accelerate Local Socket Communication — SOCKMAP eBPF splices local TCP sockets in-kernel, reducing loopback latency up to 30%.

Accelerating Local Socket Communication using eBPF

Security Advanced Use Cases

• eBPF and Linux Security Modules — Lock down Kubernetes workloads with LSM-BPF policies that trace, detect, and block runtime threats.

Securing Kubernetes Workloads using LSM-BPF [Sponsored]

Other Advanced eBPF Topics

• Modern eBPF gives you verified-safe loops and iterators—#pragma unroll, bounded loops, bpf_loop(), and object/map iterators.

Loops and Iterators in eBPF

• Tracepoints are stable but limited, kprobes can latch onto any kernel symbol with a bit more overhead, while fprobes (fentry/fexit) give the fastest inline hooks—pick the one whose trade-off of coverage vs performance best fits your tracing job.

Tracepoints, Kprobes, or Fprobes: Which One Should You Choose?

• BTF is compact kernel-type metadata that enables CO-RE (Compile-Once, Run-Everywhere).

What is BTF (BPF Type Format)?

• Easily observe all the eBPF Maps on the system using eBPF Iterators features.

eBPF Map Pressure using eBPF Iterators

---

Happy tracing, and keep 🐝‑ing!