eBPF & bcc Toolset

Extended BPF programs for tracing, networking, and security — bcc tools, bpftrace one-liners, and production use cases.

Overview

eBPF (extended Berkeley Packet Filter) lets you run sandboxed programs in the Linux kernel without changing kernel source or loading kernel modules. The kernel verifies all eBPF programs for safety (no infinite loops, no out-of-bounds access) before running them.

How It Works

Write a C program using the BPF API
Compile with Clang/LLVM to BPF bytecode
Load via bpf() syscall — kernel verifier checks safety
JIT compiler translates to native machine code
Program runs at a hook point: kprobe, tracepoint, XDP, cgroup, LSM hook, etc.

Key Hook Points

kprobes/kretprobes — dynamic instrumentation of any kernel function
tracepoints — stable kernel tracing interfaces
uprobes — user-space function tracing
XDP — network packet processing at driver level (before netstack)
TC (Traffic Control) — packet processing at tc ingress/egress
LSM hooks — security policy enforcement

bcc Toolset

The BCC (BPF Compiler Collection) provides ready-made tools:

execsnoop — Traces all exec() calls system-wide
tcpconnect — Traces TCP connect() calls
biolatency — Block I/O latency histogram
opensnoop — Traces open() syscalls
runqlat — CPU run queue latency
funccount — Counts kernel function calls

Cilium and eBPF Networking

Cilium replaces kube-proxy with eBPF programs that perform load balancing at XDP/TC layer, providing 10x lower latency for service-to-service traffic and enabling network policies without iptables rules.

Key concepts

BPF verifier: Statically analyzes every eBPF program before loading. Rejects: unbounded loops, out-of-bounds memory access, calling unsafe functions. Safety guarantee without kernel module risk.
XDP (eXpress Data Path): eBPF hook at the network driver level — processes packets before they enter the kernel network stack. Enables line-rate packet filtering, DDoS mitigation, and load balancing.
BPF maps: Kernel data structures shared between eBPF programs and user-space. Types include hash, array, ring buffer, perf event array. Used to accumulate statistics and pass data out.
kprobe: Dynamic instrumentation point on any kernel function. Can inspect arguments (entry) or return value (kretprobe). Not stable across kernel versions — prefer tracepoints for long-term tools.

When to use it

Profiling production systems with zero instrumentation overhead and no code changes
Explaining how Cilium achieves iptables-free Kubernetes networking
Security monitoring: detecting unusual exec or network patterns system-wide
Tracing application performance without adding application-level instrumentation

Interview questions

How does eBPF allow safe kernel instrumentation without kernel modules, and what does the verifier check?
How does Cilium use eBPF to replace kube-proxy, and what are the performance benefits?