and receiver among a lot of other informa�on. Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both This allows Cilium to transmit the security context of where the packet originates, which allows tracing back which container labels are assigned to the origin container. Note As the packet headers contain new instance of Cilium to manage them. monitor-aggregation - This op�on enables coalescing of tracing events in cilium monitor to only include periodic updates from ac�ve flows, or any packets that

and receiver among a lot of other information. Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both This allows Cilium to transmit the security context of where the packet originates, which allows tracing back which container labels are assigned to the origin container. Note As the packet headers contain the new instance of Cilium to manage them. monitor-aggregation - This option enables coalescing of tracing events in cilium monitor to only include periodic updates from active flows, or any packets that

Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ and receiver among a lot of other information. Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both This allows Cilium to transmit the security context of where the packet originates, which allows tracing back which container labels are assigned to the origin container. Note As the packet headers contain

Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ and receiver among a lot of other information. Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both the new instance of Cilium to manage them. monitor-aggregation - This option enables coalescing of tracing events in cilium monitor to only include periodic updates from active flows, or any packets that

Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ and receiver among a lot of other information. Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both the new instance of Cilium to manage them. monitor-aggregation - This option enables coalescing of tracing events in cilium monitor to only include periodic updates from active flows, or any packets that

Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ and receiver among a lot of other information. Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both the new instance of Cilium to manage them. monitor-aggregation - This option enables coalescing of tracing events in cilium monitor to only include periodic updates from active flows, or any packets that

Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ the new instance of Cilium to manage them. monitor-aggregation - This option enables coalescing of tracing events in cilium monitor to only include periodic updates from active flows, or any packets that in a safe manner. It is used in a number of Linux kernel subsystems, most prominently networking, tracing and security (e.g. sandboxing). Although BPF exists since 1992, this document covers the extended

can be simple log statements, or ○ More comprehensive like Open tracing. Option 2: Debugger ○ GDB ○ Delve Option 3: Linux tracing utility ○ strace/ftrace ○ LTTng/USDT Option 4: eBPF ? What are

hook point. For example, kernel probes (kprobe) or user probes (uprobe) can be added to attach eBPF tracing programs almost anywhere in kernel or user applications. eBPF is a strictly-typed assembly language performance problems. Projects such as BCC, bpftrace, Hubble, Parca, or Pyroscope use eBPF for tracing and monitoring purposes. The team flew and traveled, becoming so prosperous That the news spread

@beatrizmrg October 28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing Go function with uprobes 6 Demo time 7 Conclusions ● eBPF programs can be attached to different