--- title: "#ebpf articles | Hashnode" description: "Explore 158 articles tagged #ebpf on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/ebpf" --- Tag # #ebpf 158 posts · 23 followers [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [2d ago](https://hashnode.com/posts/pairing-a-roce-request-with-its-ack-and-why-the-queue-pair-number-is-not-enough/6af44489a4d949f08425e1af) ### [Pairing a RoCE request with its ACK, and why the queue-pair number is not enough](https://pegasus-nathanael-tech.hashnode.dev/pairing-a-roce-request-with-its-ack-and-why-the-queue-pair-number-is-not-enough?utm_source=hashnode&utm_medium=feed) An RC packet carries only its destination QP, so a write and its ACK name different QPs. The key that pairs them in XDP, and the ACKs not to trust. 4 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/pairing-a-roce-request-with-its-ack-and-why-the-queue-pair-number-is-not-enough?utm_source=hashnode&utm_medium=feed) [Ravidu Priyankara](https://hashnode.com/@ravindupriyankara) · [Nov 2](https://hashnode.com/posts/onelane-reverse-engineering-lost-updates-in-ebpf-per-cpu-counters-under-interrupt-pressure/6ae89ca2ee878ec9b148a18f) ### [OneLane: Reverse-Engineering Lost Updates in eBPF Per-CPU Counters Under Interrupt Pressure](https://ravindu-priyankara.hashnode.dev/onelane-reverse-engineering-lost-updates-in-ebpf-per-cpu-counters-under-interrupt-pressure?utm_source=hashnode&utm_medium=feed) Explore how non-atomic eBPF per-CPU counter updates can lose events under interrupt pressure through Linux kernel reverse engineering and JIT assembly 46 min read · [ravindu-priyankara.hashnode.dev](https://ravindu-priyankara.hashnode.dev/onelane-reverse-engineering-lost-updates-in-ebpf-per-cpu-counters-under-interrupt-pressure?utm_source=hashnode&utm_medium=feed) [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [Nov 1](https://hashnode.com/posts/week-2-from-a-sensor-to-an-agent/6ae7cce438877bcd79edc645) ### [Week 2: from a sensor to an agent](https://pegasus-nathanael-tech.hashnode.dev/week-2-from-a-sensor-to-an-agent?utm_source=hashnode&utm_medium=feed) A week turning one XDP sensor into an agent: what a host can really measure on RDMA, the parts it took, and what is still not proven. 4 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/week-2-from-a-sensor-to-an-agent?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/week-2-from-a-sensor-to-an-agent/6ae7cce438877bcd79edc645) [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [Oct 31](https://hashnode.com/posts/a-metrics-endpoint-a-slow-client-cannot-stall-and-labels-that-cannot-explode/6ae66950a544f99eee44648e) ### [A metrics endpoint a slow client cannot stall, and labels that cannot explode](https://pegasus-nathanael-tech.hashnode.dev/a-metrics-endpoint-a-slow-client-cannot-stall-and-labels-that-cannot-explode?utm_source=hashnode&utm_medium=feed) A timeout per read did not stop a client sending one byte at a time. How one deadline per connection and closed label lists protect a C++ agent. 4 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/a-metrics-endpoint-a-slow-client-cannot-stall-and-labels-that-cannot-explode?utm_source=hashnode&utm_medium=feed) [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [Oct 30](https://hashnode.com/posts/attaching-xdp-without-leaving-a-trace-bpf-link-kill-9-and-a-signal-mask-nobody-tests/6ae44cb13538dc023f94f887) ### [Attaching XDP without leaving a trace: bpf\_link, kill -9 and a signal mask nobody tests](https://pegasus-nathanael-tech.hashnode.dev/attaching-xdp-without-leaving-a-trace-bpf-link-kill-9-and-a-signal-mask-nobody-tests?utm_source=hashnode&utm_medium=feed) Building AgentXDP, part 9. Previous: part 8, a lock-free queue broken on purpose. Next: part 10, a metrics endpoint a slow client cannot stall. An observability agent must do no harm. If it crashes, o 4 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/attaching-xdp-without-leaving-a-trace-bpf-link-kill-9-and-a-signal-mask-nobody-tests?utm_source=hashnode&utm_medium=feed) [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [Oct 28](https://hashnode.com/posts/a-lock-free-queue-broken-on-purpose-to-prove-it-works/6ae14fb46a57529b5756a1a3) ### [A lock-free queue, broken on purpose to prove it works](https://pegasus-nathanael-tech.hashnode.dev/a-lock-free-queue-broken-on-purpose-to-prove-it-works?utm_source=hashnode&utm_medium=feed) Building AgentXDP, part 8. Part 7 built the histogram that the kernel and the agent fill the same way. This part builds the road events take inside the agent: a queue between two threads, with no lock 4 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/a-lock-free-queue-broken-on-purpose-to-prove-it-works?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/a-lock-free-queue-broken-on-purpose-to-prove-it-works/6ae14fb46a57529b5756a1a3) [Coding Macaw Bootcamp](https://hashnode.com/@codingmacawbootcamp) · [Oct 20](https://hashnode.com/posts/mastering-red-and-blue-team-operations-in-2026-ai-rust-and-faang-standards/6ad7c0a9ee0507af7703eef7) ### [Mastering Red and Blue Team Operations in 2026: AI, Rust, and FAANG Standards](https://codingmacawbootcamp.hashnode.dev/mastering-red-and-blue-team-operations-in-2026-ai-rust-and-faang-standards?utm_source=hashnode&utm_medium=feed) Explore how AI, Rust, and eBPF are reshaping Red and Blue Team operations. Learn what US software engineers need to know to meet FAANG standards. 4 min read · [codingmacawbootcamp.hashnode.dev](https://codingmacawbootcamp.hashnode.dev/mastering-red-and-blue-team-operations-in-2026-ai-rust-and-faang-standards?utm_source=hashnode&utm_medium=feed) [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [Oct 17](https://hashnode.com/posts/week-1-from-zero-to-a-verified-xdp-sensor/6ad2d925d65fc5a31da25d80) ### [Week 1: from zero to a verified XDP sensor](https://pegasus-nathanael-tech.hashnode.dev/week-1-from-zero-to-a-verified-xdp-sensor?utm_source=hashnode&utm_medium=feed) Building AgentXDP, part 4: the week in one page. Part 1 defined the event, part 2 parsed RoCE v2 under the verifier, part 3 proved the agent needs three capabilities, not root. The problem AI clusters 3 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/week-1-from-zero-to-a-verified-xdp-sensor?utm_source=hashnode&utm_medium=feed) [Nathanael FETUE](https://hashnode.com/@nathanael-fetue) · [Oct 16](https://hashnode.com/posts/not-root-proving-an-xdp-agent-needs-exactly-three-capabilities/6ad1818ceec3044d0b2772ef) ### [Not root: proving an XDP agent needs exactly three capabilities](https://pegasus-nathanael-tech.hashnode.dev/not-root-proving-an-xdp-agent-needs-exactly-three-capabilities?utm_source=hashnode&utm_medium=feed) Building AgentXDP, part 3. Part 2 parsed RoCE v2 inside an XDP program. This part is about the permission to load it: how much power the agent really needs, and how the tests prove it, on my VM and in 5 min read · [pegasus-nathanael-tech.hashnode.dev](https://pegasus-nathanael-tech.hashnode.dev/not-root-proving-an-xdp-agent-needs-exactly-three-capabilities?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/not-root-proving-an-xdp-agent-needs-exactly-three-capabilities/6ad1818ceec3044d0b2772ef) [George Ezejiofor](https://hashnode.com/@georgeezejiofor) · [Oct 12](https://hashnode.com/posts/cilium-hubble-microservice-traffic-flow-ebpf/6acd45604ca43fb637c06c76) ### [Cilium Hubble on RKE2: Microservice Traffic Observability (Seeing the Invisible)](https://georgeezejiofor.com/cilium-hubble-microservice-traffic-flow-ebpf?utm_source=hashnode&utm_medium=feed) Cilium Hubble on RKE2: Microservice Traffic Observability (Seeing the Invisible) 19 min read · [georgeezejiofor.com](https://georgeezejiofor.com/cilium-hubble-microservice-traffic-flow-ebpf?utm_source=hashnode&utm_medium=feed)