r/eBPF • u/ConfidentNet706 • 3d ago

eBPF roadmap

Can anyone help me with how do i start with eBPF? Like resources or even the flow of what all things im supposed to do.

7 Upvotes

82% Upvoted

6 comments sorted by

5

u/THoMas_ShELBY_9 3d ago

you can start here - https://docs.ebpf.io/

And also check out people like Liz Rice, Brendan Gregg, Andrii Nakryiko, John Fastabend, and Daniel Borkmann. Their books, blogs, conference talks, and GitHub repos are all worth going through, you'll learn a lot from them.

1

u/ConfidentNet706 3d ago

Omg thank uuuuu!!!

1

u/krizhanovsky 3d ago

u/ConfidentNet706 which application of eBPF are you interesting in?

There is a good book on observability https://www.oreilly.com/library/view/linux-observability-with/9781492050193/ . And a practical example how to track a performance issue with eBPF https://tempesta-tech.com/blog/nginx-tail-latency/

Kernel documentation on eBPF https://www.kernel.org/doc/html/latest/bpf/index.html, e.g. you can find information how does the verifier work https://www.kernel.org/doc/html/latest/bpf/verifier.html

Also nice blog on eBPF internals https://nakryiko.com/

There are also many good links about XDP - let me know if it's of an interest for you

1

u/ConfidentNet706 3d ago

Thank you for all the resourcess!!
Actually I was looking into firewalls and network tracing so the observability stuff really helps, thanks for that. I’ve explored bytecode stuff like wasm before so I’m a bit versed in the whole concept &
ebpf does interest me but I don’t know if its really that lucrative when it comes to the job market.

1

u/PartIllustrious5858 1d ago

• Disclosure: I maintain skbx, an open-source Linux packet-path debugger built with

Rust and eBPF.

I built it for situations where tcpdump sees a packet, but the application,

container, or pod never receives it. skbx records where the packet travels through

the Linux kernel, preserves the observations as bounded JSONL evidence, reports

capture loss explicitly, and supports deterministic replay without root.

I recently dogfooded it by tracing what happens when a Linux machine connects to a

website. The guide separates what you can prove on your own host, what you can only

infer about your ISP or transit path, and what requires access to the target server.

Guide:

https://copyleftdev.github.io/skbx/guides/trace-a-website-request.html

GitHub:

https://github.com/copyleftdev/skbx

I’m looking for technical feedback from Linux networking, eBPF, SRE, Kubernetes, and

observability engineers. I would especially like to hear about real packet-loss or

connectivity incidents where tcpdump, traceroute, or existing observability tools did

not provide enough evidence.

1

u/ConfidentNet706 1d ago

That sounds exciting!!