4 ms·
What is the advantage of eBPF hooks over the ptrace system call ? Can't I do most of the same stuff with it ?
by IceWreck 4y ago
What is the advantage of eBPF hooks over the ptrace system call ? Can't I do most of the same stuff with it ?
- carom 4y agoSafety. Kernel level targeting rather than process.
- Matthias247 4y agoTracing is just one area where eBPF can be used. However there are lot of other applications. E.g. you can do a lot of low level networking (forward packets to another host before they go into the kernel for building a router or load balancer, drop packets for a firewall) using the XDP eBPF hooks. You can have some on-host TCP policies - e.g. which thread handles a new incoming connection - expressed as eBPF hooks. And there's more.
- alexgartrell 4y agoeBPF is also a lot more efficient than ptrace