eBPF Kernel-Power für Alle - IKT Dornbirn 2025

Was Sie im Workshop praktisch nachvollziehen und (in Teil 2) anwenden werden:

Netzwerk-Transparenz: Visualisierung aller Netzwerkverbindungen in Echtzeit.
TLS-Intercept: Mitschneiden und Anzeigen von SSL/TLS-verschlüsseltem Traffic im Klartext.
Datenbank-Protocol-Tracing: Live-Anzeige von Datenbank-Protokollen im Klartext (z.B. Redis, SQL, Kafka).
Dynamische Firewalls: Echtzeitschaltung auf TCP/IP Ebene (L3/4) und Anwendungsebene (L7).
Schwachstellen-Jagd: Detektion von Aufrufen verwundbarer Software-Bibliotheken (am Beispiel der xz/liblzma-Schwachstelle).
Verhaltensanalyse & Anomalieerkennung: Erstellung dynamischer Verhaltensprofile von Anwendungen.
Runtime Security: Blockieren der Ausführung spezifischer, als gefährlich eingestufter Befehle.
Shell-Überwachung: Mitlesen und Analysieren von interaktiven Shell-Kommandos.

zweiter Teil: 15-1600 Uhr (this one could be in English depending on the Audience Requirements) All of the above hands-on plus Difference between observability and security: its not security if it got outprioritized by e.g. rate-limiting User-space ebpf: a short intro to eunomia-bpf and how that is different

Willkommen in der Kernel Welt

Loading content...

Loading tutorial...

Discussion:  Discord
Categories: Linux, Security
Tags:  #ebpf #kernel

How to Author Trainings on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull training content

labctl content pull training ebpfintrodeutsch-d3dd1c6c

This will create a local copy of the training content in a directory named ebpfintrodeutsch-d3dd1c6c. You only need to do this once per training.

Stream your changes

labctl content push -fw training ebpfintrodeutsch-d3dd1c6c

Run this command in a separate terminal to continuously upload your changes to the server while editing the training in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Leave Training

Are you sure you want to leave this training?

Withdraw Request

Are you sure you want to withdraw your request to join this training?