4 ms·
You can do the same on Linux, just not easily from the command line; ebpf however can do all this and more. Once you have built it you can just create a program
by tankenmate 2y ago
You can do the same on Linux, just not easily from the command line; ebpf however can do all this and more. Once you have built it you can just create a program that you can use from the command line. There are guides out there to show you how.[0]
[0] https://www.datadoghq.com/blog/ebpf-guide/ https://www.datadoghq.com/blog/ebpf-guide/
- carlmr 2y agoI've been meaning to try out eBPF. I read a tutorial on writing a simple perf application in Rust, but I kind of lack the intuition to know what it's good for. Do you know a good overview of what can be done with eBPF?
- packetlost 2y agoThink of it like small, isolated programs that run in a VM that is managed by the kernel and has access to many kernel APIs and datastructures without needing to do syscalls. I believe they can both monitor and manipulate data as it flows through the OS primatives (sockets, file descriptors, etc.).