home ¦ Archives ¦ Atom ¦ RSS

More Linux Tracing Fun

I find deep dives into eBPF and Linux tracing fascinating. Jean-Tiare Le Bigot has a basic eBPF intro and then an interesting application to single host, L2 level, network packet tracing.

eBPF/bcc enables us to write a new range of tools to deeply troubleshoot, trace and track issues in places previously unreachable without patching the kernel. Tracepoints are also quite handy as they give a good hint on interesting places, removing the need to tediously read the kernel code and can be placed in portions of the code that would otherwise be unreachable from kprobes, like inline or static functions.

Also, I learned about the mtr utility.

© 2008-2024 C. Ross Jam. Built using Pelican. Theme based upon Giulio Fidente’s original svbhack, and slightly modified by crossjam.