Learning eBPF

DESCRIPTION Unlock the power of eBPF, the revolutionary Linux kernel technology transforming observability, networking, and security. This book serves as your comprehensive resource to master this cutting-edge technology, whether you are a beginner exploring its potential or a seasoned professional seeking in-depth knowledge. Embark on a structured learning journey, starting with classic BPF (cBPF) and its evolution to modern eBPF, grasping its architecture and core programming primitives like the BPF syscall and various program/attachment types. Discover practical development using key eBPF programming libraries such as libbpf and bpftrace, and learn to write your first program. Explore BPF portability with CO-RE and efficient eBPF deployment. Uncover potent applications in eBPF observability (kprobes, tracepoints), eBPF networking (XDP, socket filters), and eBPF security. Finally, delve into key eBPF open-source projects like Cilium and Falco. By the end of this definitive guide, you will possess a robust understanding of eBPF, equipped with the practical skills to develop, deploy, and leverage its immense capabilities across diverse domains, making you a proficient practitioner in this transformative field. WHAT YOU WILL LEARN ¿ cBPF history, eBPF architecture, core primitives, and deployment. ¿ eBPF programming, portability, observability, networking, and security. ¿ BPF evolution, eBPF internals, practical application, and ecosystem. ¿ Kernel probing, packet manipulation, and secure eBPF development. ¿ eBPF tools, libraries, deployment strategies, and open-source projects. ¿ Tracing kernel/user space, network filtering/modification, and security enforcement. WHO THIS BOOK IS FOR Whether you are a software developer, network engineer, security professional, or systems administrator, this book provides the knowledge to leverage eBPF for enhanced system observability, advanced networking, and security enforcement in your environment.