Networking
See and shape packets: TCP connection latency and state, L7 tracing, sockops, TC, and XDP — including a load balancer and packet capture.
tcpconnlat
Open Part 4 by building out the second VM and measuring active TCP connection latency — connect() to SYN-ACK — with kprobes on the kernel TCP stack keyed by the socket pointer, reading struct fields by offset.
tcpstates
Trace every TCP connection through its state machine using the single stable sock:inet_sock_set_state tracepoint — the clean, offset-light counterpart to Chapter 27's kprobes, with the endpoints handed to you directly.
L7 tracing: HTTP
Parse application-layer HTTP out of raw packets with a socket-filter program — walking Ethernet, IPv4, and TCP headers to the payload — and weigh it against the syscall/uprobe approach for encrypted or buffer-level L7.
sockops
Meet a different model: a sock_ops program attached to a cgroup that the TCP stack calls back at connection-lifecycle moments, handing you the 4-tuple directly — and that can also act on the socket, not just observe it.
tc-BPF: acting on packets
Move from observing traffic to acting on it: attach a classifier to the clsact qdisc, count egress packets per protocol in-kernel, and drop traffic to a port with a TC_ACT_SHOT verdict.
XDP: the earliest hook
Drop and count packets at XDP — the eXpress Data Path, in the driver before an sk_buff is allocated. The fastest eBPF hook, raw packet pointers, and the bounds-checking discipline the verifier demands.
XDP capture: a tcpdump in eBPF
Use XDP to observe rather than drop: parse and filter packets in the kernel, and ship only the interesting ones (TCP SYN/FIN/RST) to user space through a ring buffer for a live tcpdump-style view of connection activity.
XDP load balancer: rewriting packets
Make XDP forward, not just observe: a UDP load balancer that rewrites the destination port of packets aimed at a virtual port, round-robins them across backends through a map, and passes them on — the packet-mutation and backend-selection core of an XDP load balancer.
Testing eBPF with BPF_PROG_TEST_RUN
Unit-test eBPF programs without a NIC or live traffic: feed a hand-built packet to a loaded program with BPF_PROG_TEST_RUN, get back the verdict, output buffer, and duration, and assert on them — turning a verifier-only check into a real test suite.
tcx: the modern tc attach
Attach tc programs the modern way: tcx (kernel 6.6+) replaces the clsact-qdisc wiring with bpf_link ownership and a kernel-managed ordering of multiple programs per hook — auto-detach on close, no manual qdisc, and composable with other tools.