Search Articles — Sudonull

https://sudonull.com/ebpf-netflow-traffic-monitoring-bare-metal-k8s

Setting up eBPF/XDP for NetFlow statistics: PERCPU_HASH, sharding, timers. Benchmarks and code for middle/senior dev. Master high-performance telemetry collection.

https://sudonull.com/ebpf-rootkit-in-linux-db-leak-via-contractor

Breakdown of a real eBPF rootkit case: symptoms, detection with bpftool, attack chain via contractor. Protection measures for Linux servers: 2FA, bpf() audit, Falco. Learn how to prevent PII exfiltration.

https://sudonull.com/ebpf-server-diagnostics-in-60-sec-melisai

Automate Linux metrics collection: eBPF, BCC, procfs to JSON in a minute. 37 anomaly rules, AI integration, rate-metrics. Save 30–40 min per incident. Download and test.

https://sudonull.com/little-snitch-linux-ebpf-traffic-monitoring

Breakdown of Little Snitch for Linux: eBPF firewall with process-aware blocking, web interface and blocklists. Learn the architecture, trade-offs and production setup. Ideal for DevOps and security.

https://sudonull.com/little-snitch-linux-ebpf-firewall

Learn about the Linux version of Little Snitch: eBPF application traffic monitoring, blocking by IP/domains, web interface. Installation and comparison with OpenSnitch for developers.

eBPF - Introduction, Tutorials & Community Resources

https://ebpf.io/

eBPF is a revolutionary technology that can run sandboxed programs in the Linux kernel without changing kernel source code or …

What is eBPF? An Introduction and Deep Dive into the eBPF Technology

https://ebpf.io/what-is-ebpf/

A detailed step by step introduction to the eBPF technology with lots of references for further reading.

eBPF - Wikipedia

https://en.wikipedia.org/wiki/EBPF

It is the successor to the Berkeley Packet Filter (BPF, with the "e" originally meaning "extended") filtering mechanism in Linux and is …

Home – eBPF

https://ebpf.foundation/home/

eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It …

eBPF Beginner Skill Path - labs.iximiuz.com

https://labs.iximiuz.com/skill-paths/ebpf-beginner-skill-path-aa16c6e8

Oct 9, 2025 · In this tutorial, you’ll run a pre-written eBPF program and explore how it’s loaded and hooked into the kernel. By the …

GitHub - cilium/ebpf: ebpf-go is a pure-Go library to read, modify and ...

https://github.com/cilium/ebpf

ebpf-go is a pure Go library that provides utilities for loading, compiling, and debugging eBPF programs. It has minimal external …

eBPF Tutorial by Example 1: Hello World, Framework and Development …

https://eunomia.dev/tutorials/1-helloworld/

Aug 10, 2023 · By studying this tutorial, you will master the basic knowledge of eBPF development and lay a solid foundation for …

GitHub - eunomia-bpf/bpf-developer-tutorial: eBPF Developer …

https://github.com/eunomia-bpf/bpf-developer-tutorial

It provides practical eBPF development practices from beginner to advanced, including basic concepts, code examples, and real …

What is eBPF? - IBM

https://www.ibm.com/think/topics/ebpf

Sep 13, 2023 · eBPF is a programming technology that can run sandboxed programs in privileged contexts such as the Linux …

eBPF Explained: Use Cases, Concepts, and Architecture - Tigera

https://www.tigera.io/learn/guides/ebpf/

Extended Berkeley Packet Filter (eBPF) is a Linux kernel technology that runs sandboxed programs in kernel space to power …