eBPF still gets filed under "observability tool". that undersells it badly you load code straight into a running kernel, no reboot, no kernel module, no waiting three weeks for a patch window Cloudflare uses it to kill DDoS traffic at the network card, before a packet ever reaches the kernel's normal network stack. millions of packets a second, dropped for almost nothing Meta built Katran, a load balancer that runs entirely inside the kernel. no proxy hop, no extra trip through userspace Cilium used the same trick to kill the sidecar. service meshes used to mean bolting an Envoy container onto every single pod, burning CPU nobody asked for. now the routing happens in-kernel and the sidecar is just gone the one that actually got me: you can trace every syscall an AI agent makes, every file it opens, every socket it touches, without changing a line of its code. it shows what the agent did on the machine, not what it printed to its own log I spent years assuming the kernel was off-limits unless you were writing a driver. wrong assumption a few dozen lines of eBPF and you're running your own code inside it, with a verifier making sure you can't crash the box been down this hole far enough to build pktz: eBPF network monitor, per process, per connection, live - github.com/immanuwell/pktz what's the strangest thing you've built with this?

one CPU core can look at 28.8 million packets a second before the Linux kernel even wakes up that's XDP. it runs inside the network driver, before the kernel allocates memory for the packet, before there's a socket, before there's a stack. it just gets to decide: keep this, or throw it away, right now most backend engineers never touch this layer in their whole career. I think that's a shame, because the stuff built on top of it is wild: - Cloudflare drops over 10 million packets a second per core with it. they've auto-mitigated 100+ attacks above 2 billion packets per second, one of them a 3.8 Tbps flood, and nobody on their team touched a keyboard - Meta's load balancer (Katran) runs this at every Facebook data center. the old way, iptables-style, tops out around a million packets a second per core and pins the CPU at 90% doing it. Katran does 10-100x that - Cilium uses the same trick to rip iptables out of Kubernetes entirely. their own benchmarks show p99 network latency dropping from 45ms to under 2ms after the switch all three are the same idea wearing different hats: read the packet before the OS does, decide fast, skip everything you don't need I got curious enough to build a tiny version myself, an XDP load balancer with Maglev hashing, no shortcuts. on one core of a normal laptop it pushed 9 million+ packets a second with zero drops. that's a laptop, not a data center NIC code's here if you want to see how it works (written in Zig btw): github.com/immanuwell/ringze… what's the most "the kernel isn't supposed to be able to do that" thing you've seen eBPF pull off?