zrouga

3 ms·

1. 1.▲
   by zrouga 9mo ago

   Thanks! eBPF has been a big win for us. Once you get past the verifier constraints, it really changes how you think about observability — pushing filtering and classification into the kernel reduces noise and makes the data much more action
2. 2.▲
   by zrouga 9mo ago

   Yes — Sysdig/csysdig are great tools and I’ve used them before. They’re excellent for syscall-level visibility and host/container forensics. Cerberus targets a different layer: always-on, low-overhead network classification in CNI
3. 3.▲
   by zrouga 9mo ago

   Not exactly — that statement is only partly correct. Yes, tcpdump and Wireshark do use libpcap for packet capture and filtering. libpcap compiles the familiar tcpdump filter syntax into classic BPF (cBPF) programs that run in the kernel to
4. 4.▲
   Show HN: Cerberus – Real-time network monitor with eBPF(github.com)

   12 points by zrouga 10mo ago|6 comments