Search Articles — Sudonull

https://sudonull.com/sched-ext-bpf-schedulers-in-linux-6-12

Explore sched_ext — a new class of schedulers in the Linux 6.12 kernel. Dynamic policy replacement via BPF for optimization under workloads. Benchmarks, examples, scenarios.

https://sudonull.com/ebpf-rootkit-in-linux-db-leak-via-contractor

Breakdown of a real eBPF rootkit case: symptoms, detection with bpftool, attack chain via contractor. Protection measures for Linux servers: 2FA, bpf() audit, Falco. Learn how to prevent PII exfiltration.

https://sudonull.com/ebpf-netflow-traffic-monitoring-bare-metal-k8s

Setting up eBPF/XDP for NetFlow statistics: PERCPU_HASH, sharding, timers. Benchmarks and code for middle/senior dev. Master high-performance telemetry collection.

BPF Documentation — The Linux Kernel documentation

https://www.kernel.org/doc/html/latest/bpf/index.html

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF). This kernel side documentation is still work in progress.

Berkeley Packet Filter - Wikipedia

https://en.wikipedia.org/wiki/Berkeley_Packet_Filter

The Berkeley Packet Filter (BPF; also BSD Packet Filter, classic BPF or cBPF) is a network tap mechanism and packet filter which permits computer network packets to be captured and filtered at …

bpf (2) - Linux manual page - man7.org

https://www.man7.org/linux/man-pages/man2/bpf.2.html

Extended BPF (or eBPF) is similar to the original ("classic") BPF (cBPF) used to filter network packets.

BPF Performance Tools (book) - Brendan Gregg

https://www.brendangregg.com/bpf-performance-tools-book.html

Berkeley Packet Filter (BPF) is an in-kernel execution engine that processes a virtual instruction set, and has been extended recently (aka eBPF) for providing a safe way to extend kernel functionality.

GitHub - iovisor/bcc: BCC - Tools for BPF-based Linux IO analysis ...

https://github.com/iovisor/bcc

BCC makes BPF programs easier to write, with kernel instrumentation in C (and includes a C wrapper around LLVM), and front-ends in Python and lua. It is suited for many tasks, including performance …

BPF in Linux Explained: How Berkeley Packet Filter and eBPF Work

https://serverspace.io/support/help/what-is-bpf-in-linux-and-how-does-it-work/

Apr 14, 2025 · What are BPF and eBPF? BPF or Berkley Packet Filter is a virtual machine inside the OS kernel, which allows you to load arbitrary code into it. The algorithm of this solution is tied to system …

Introduction to BPF | LINUX Berkeley Packet Filter | CodiLime

https://www.youtube.com/watch?v=qXFi-G_7IuU

Nov 18, 2022 · In this video, our Senior Software Engineer Lukasz Kszonowski introduces the Berkeley Packet Filter - BPF. It is a Linux Kernel technology that allows you to monitor the traffic in your cluster.

Home - Banca Popolare del Frusinate

https://www.bpf.it/

Il libretto di risparmio dedicato a chi non ha ancora compiuto il diciottesimo anno di età. Il prestito d’onore che ti accompagna fino alla laurea. Prestito d’onore fino a 10.000€ al tasso fisso 1,00% senza …

Linux Extended BPF (eBPF) Tracing Tools - Brendan Gregg

https://www.brendangregg.com/ebpf.html

The BPF program has two ways to pass measured data back to user space: either per-event details, or via a BPF map. BPF maps can implement arrays, associative arrays, and histograms, and are suited …

BPF and XDP Reference Guide — Cilium 1.19.5 documentation

https://docs.cilium.io/en/stable/reference-guides/bpf/

BPF is a highly flexible and efficient virtual machine-like construct in the Linux kernel allowing to execute bytecode at various hook points in a safe manner. It is used in a number of Linux kernel subsystems, …