4 ms·

According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/B

According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter

yjftsjthsd-h 5y ago
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ https://ebpf.io/ is a decent starting point for reading.
- alexchamberlain 5y ago
  Thanks for explaining that - I was totally missing the point to be honest.
  - yjftsjthsd-h 5y ago
    Yeah, the name is kinda unfortunate in the modern context, but in fairness it's easy to not expect that a packet filtering framework will turn out to be the basis for a universal kernel tracing system...
- hn_throwaway_99 5y ago
  My biggest pet peeve is when authors don't just start with a 1-2 sentence outline of the topic that they're discussing, and instead go directly into acronym soup. And I've been in software development for a long time and have never heard of BPF/eBPF before. Thank you for your explanation.
  - enedil 5y ago
    Brendan Gregg is the author of eBPF, and he writes on his blog. It is fair to assume a basic knowledge of his works when reading his website.
    - bch 5y ago
      Maybe I’m misunderstanding what you mean by “author“, but BPF was invented by Steven McCanne, and Van Jacobson in 1992[0], and tweaked over the years by various developers and operating systems. It looks[1] like the Linux eBPF work was initiated by Alexei Starovoitov, and came to be exposed to users c. 2014. [0] https://en.wikipedia.org/wiki/Berkeley_Packet_Filter https://en.wikipedia.org/wiki/Berkeley_Packet_Filter [1] https://lwn.net/Articles/740157/ https://lwn.net/Articles/740157/
      - Ristovski 5y ago
        Brendan Gregg is the author of most of the utilities, not bpf/ebpf itself. You can find a non-exhaustive list here: http://www.brendangregg.com/ebpf.html http://www.brendangregg.com/ebpf.html
        bch 5y ago
        I get that, and appreciate he’s productive and sharing his skill. I wasn’t sure though if the long history of other people’s hard work wasn’t being swept up in appreciation for ‘brendangregg
      - brendangregg 5y ago
        Thanks; I also summarize the history of eBPF in my BPF Performance Tools book (which I had checked by Alexei & Dan) and list the main contributors in the Acknowledgements page, as well as include them in talks (e.g. https://www.slideshare.net/brendangregg/bpf-internals-ebpf/122 https://www.slideshare.net/brendangregg/bpf-internals-ebpf/1...). I do try hard to thank all involved. :-) Modern BPF (eBPF) was created by Alexei Starovoitov and Daniel Borkmann, who are still maintainers but are joined by over a hundred contributors. I've spent most of my time contributing to the observability frontends, bcc and bpftrace. Apart from the people, the major companies contributing include Facebook and Isovalent; Microsoft are becoming its own major contributor to its own Windows implementation.
        Bayart 5y ago
  - mhh__ 5y ago
    Brendan Gregg literally wrote the book on this kind of stuff, if you search for any of this tracing stuff it comes up with his website anyway.
  - brendangregg 5y ago
    Sorry, I just added a link to https://ebpf.io https://ebpf.io. Although I suspect that will also annoy people as it doesn't explain the BPF acronym: The reason is that we're now treating BPF as a technology name (like LLVM) and not an acronym, as the historical acronym (Berkeley Packet Filter) is plain confusing. I think the real problem is that BPF was built by engineers without professional marketing help, who would have come up with a better name!
    - hn_throwaway_99 5y ago
      Thank you!
  - quickthrower2 5y ago
    He did link to something, but for me that link was broken (https://brendangregg.com/blog/2021-07-03/BPF https://brendangregg.com/blog/2021-07-03/BPF)
  - kbenson 5y ago
    That's more because you're coming into an established site with an established topic that's been discussed for years. It doesn't really make sense to introduce every topic from scratch every time, because the assumption after a while is that the people reading have at least some prior knowledge or at least an interest in looking up what they don't know because they're there for a reason. In other words, not every site is designed around link aggregators like HN, and some things will be assumed, just as if you open a book to some random chapter.
WillDaSilva 5y ago
And eBPF stands for extended Berkeley Packet Filter: > eBPF is an extended BPF JIT virtual machine in the Linux kernel It's really quite an amazing tool, especially since you can use it to run sandboxed programs in kernel without changing kernel source or loading a kernel module. These programs can be written using a limited dialect of C. Some examples of its use can be found here: https://github.com/iovisor/bcc/tree/master/examples https://github.com/iovisor/bcc/tree/master/examples
ww520 5y ago
eBPF is more capable of BPF. It's a general hooking mechanism in the Linux kernel. Think Aspect-Oriented Programming, but in the kernel. The biggest benefit I think is that it can intercept and modify function calls in many places, not just the kernel. Intercepting/filtering bad data at the network driver level is much more efficient than letting the data reaching the kernel code.
puptelpete 5y ago
For me, BPF is the most exciting development in the kernel world for ages. Brendan Gregg, the author of the posted blog entry, works with BPF on observability at Netflix and delivered a keynote at UbuntuMasters 2019. The video is on his blog is a great intro. [0] I've been watching BPF for a couple of years now, and it seems slow on the uptake, but I hope Gregg is right that people will eventually start writing new drivers, firewalls, observability and security tools, loaded from userspace, but all running safely in a kernel vm, maybe even written in new async-first programming languages. [0] https://brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html https://brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-s...

yjftsjthsd-h 5y ago

Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ https://ebpf.io/ is a decent starting point for reading.

alexchamberlain 5y ago
Thanks for explaining that - I was totally missing the point to be honest.
- yjftsjthsd-h 5y ago
  Yeah, the name is kinda unfortunate in the modern context, but in fairness it's easy to not expect that a packet filtering framework will turn out to be the basis for a universal kernel tracing system...
hn_throwaway_99 5y ago
My biggest pet peeve is when authors don't just start with a 1-2 sentence outline of the topic that they're discussing, and instead go directly into acronym soup. And I've been in software development for a long time and have never heard of BPF/eBPF before. Thank you for your explanation.
- enedil 5y ago
  Brendan Gregg is the author of eBPF, and he writes on his blog. It is fair to assume a basic knowledge of his works when reading his website.
  - bch 5y ago
    Maybe I’m misunderstanding what you mean by “author“, but BPF was invented by Steven McCanne, and Van Jacobson in 1992[0], and tweaked over the years by various developers and operating systems. It looks[1] like the Linux eBPF work was initiated by Alexei Starovoitov, and came to be exposed to users c. 2014. [0] https://en.wikipedia.org/wiki/Berkeley_Packet_Filter https://en.wikipedia.org/wiki/Berkeley_Packet_Filter [1] https://lwn.net/Articles/740157/ https://lwn.net/Articles/740157/
    - Ristovski 5y ago
      Brendan Gregg is the author of most of the utilities, not bpf/ebpf itself. You can find a non-exhaustive list here: http://www.brendangregg.com/ebpf.html http://www.brendangregg.com/ebpf.html
      - bch 5y ago
        I get that, and appreciate he’s productive and sharing his skill. I wasn’t sure though if the long history of other people’s hard work wasn’t being swept up in appreciation for ‘brendangregg
    - brendangregg 5y ago
      Thanks; I also summarize the history of eBPF in my BPF Performance Tools book (which I had checked by Alexei & Dan) and list the main contributors in the Acknowledgements page, as well as include them in talks (e.g. https://www.slideshare.net/brendangregg/bpf-internals-ebpf/122 https://www.slideshare.net/brendangregg/bpf-internals-ebpf/1...). I do try hard to thank all involved. :-) Modern BPF (eBPF) was created by Alexei Starovoitov and Daniel Borkmann, who are still maintainers but are joined by over a hundred contributors. I've spent most of my time contributing to the observability frontends, bcc and bpftrace. Apart from the people, the major companies contributing include Facebook and Isovalent; Microsoft are becoming its own major contributor to its own Windows implementation.
      - Bayart 5y ago
- mhh__ 5y ago
  Brendan Gregg literally wrote the book on this kind of stuff, if you search for any of this tracing stuff it comes up with his website anyway.
- brendangregg 5y ago
  Sorry, I just added a link to https://ebpf.io https://ebpf.io. Although I suspect that will also annoy people as it doesn't explain the BPF acronym: The reason is that we're now treating BPF as a technology name (like LLVM) and not an acronym, as the historical acronym (Berkeley Packet Filter) is plain confusing. I think the real problem is that BPF was built by engineers without professional marketing help, who would have come up with a better name!
  - hn_throwaway_99 5y ago
    Thank you!
- quickthrower2 5y ago
  He did link to something, but for me that link was broken (https://brendangregg.com/blog/2021-07-03/BPF https://brendangregg.com/blog/2021-07-03/BPF)
- kbenson 5y ago
  That's more because you're coming into an established site with an established topic that's been discussed for years. It doesn't really make sense to introduce every topic from scratch every time, because the assumption after a while is that the people reading have at least some prior knowledge or at least an interest in looking up what they don't know because they're there for a reason. In other words, not every site is designed around link aggregators like HN, and some things will be assumed, just as if you open a book to some random chapter.

WillDaSilva 5y ago

And eBPF stands for extended Berkeley Packet Filter: > eBPF is an extended BPF JIT virtual machine in the Linux kernel It's really quite an amazing tool, especially since you can use it to run sandboxed programs in kernel without changing kernel source or loading a kernel module. These programs can be written using a limited dialect of C. Some examples of its use can be found here: https://github.com/iovisor/bcc/tree/master/examples https://github.com/iovisor/bcc/tree/master/examples

ww520 5y ago

eBPF is more capable of BPF. It's a general hooking mechanism in the Linux kernel. Think Aspect-Oriented Programming, but in the kernel. The biggest benefit I think is that it can intercept and modify function calls in many places, not just the kernel. Intercepting/filtering bad data at the network driver level is much more efficient than letting the data reaching the kernel code.

puptelpete 5y ago

For me, BPF is the most exciting development in the kernel world for ages. Brendan Gregg, the author of the posted blog entry, works with BPF on observability at Netflix and delivered a keynote at UbuntuMasters 2019. The video is on his blog is a great intro. [0] I've been watching BPF for a couple of years now, and it seems slow on the uptake, but I hope Gregg is right that people will eventually start writing new drivers, firewalls, observability and security tools, loaded from userspace, but all running safely in a kernel vm, maybe even written in new async-first programming languages. [0] https://brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html https://brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-s...