Explore tutorials, challenges, courses, and more published by this author.
Learn how an eBPF/XDP-based NAT Layer 4 load balancer works by building one from scratch. We implement simple connection tracking, deterministic hashing, and IP/MAC rewriting with a small, easy-to-follow example.
Learn how to build an eBPF/XDP firewall that filters packets by IP ranges using BPF_MAP_TYPE_LPM_TRIE and longest-prefix matching.
In this tutorial, you’ll learn the fundamentals of eBPF and XDP through example code that parses packets across different protocol layers, demonstrates how XDP actions work, and shows how these building blocks form the foundation for high-performance networking applications.
Learn how to implement a basic per-client ICMPv6 packet rate limiter using eBPF/XDP. This tutorial shows how to track client activity with eBPF maps and enforce limits directly in the kernel—without any user-space interaction.
In this tutorial, we look at why eBPF programs can fail across kernel versions due to changes in structs, tracepoints, and function layouts. We look at examples of how these differences cause portability issues and how BPF CO-RE, BTF and vmlinux.h address them.
In this tutorial, you’ll learn how to make your eBPF programs portable across kernels that lack built-in BTF support.
In this challenge, you’ll debug and fix a deliberately “broken” eBPF program, then prove it’s running by identifying its program and map IDs. Along the way, you’ll explore bpftool, check which helpers are supported, and dig into details like the UID of the loader. Finally, you’ll test your knowledge of eBPF maps by recalling the flag that only inserts a key if it doesn’t already exist.
Learn eBPF from the ground up — from writing and running your first program, to storing data in eBPF maps, inspecting and monitoring kernel activity using bpftool and bpftop, and understanding how the verifier ensures safe eBPF execution. Finish with a hands-on challenge to put your new skills to the test.
In this learning path, you’ll go from comparing different tracing program types — tracepoints, raw tracepoints, kprobes, and fprobes — to writing portable eBPF programs that work reliably across environments. You’ll also understand the role of BTF and learn how to make your eBPF code portable even when BTF isn’t available on the target system.
