►
From YouTube: eBPF Observability
Description
No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).
A
This
is
because
I'm
always
eager
to
learn
new
stuff
and
open
to
suggestions.
So
let's
connect
and
exchange
ideas,
just
like
many
others.
I've
completed
all
the
tv
shows
and
movies
and
all
the
streaming
services
and
for
a
change
of
pace.
I
started
to
do
the
calico
evpf
certification
course,
which
led
me
to
an
interesting
paper
from
the
90s
that
proposed
berkeley
packet,
filtering
or
bpf,
which
to
me
is
like
the
best
conversation
starter
for
any
kind
of
parties.
A
A
Helico
is
an
open
source,
networking
and
network
security
solution
for
containers,
virtual
machines
and
native
host-based
workloads.
It
is
important
to
note
that
caligo
is
not
just
a
kubernetes
cni.
In
fact,
calco
supports
a
broad
range
of
platforms,
including
openshift,
mirantis,
openstack
and
bare
metals.
A
Project
calico
is
an
active
community
about
the
cloud.
Networking
and
security
feel
free
to
join
our
community.
Using
these
social
networking
handles,
you
can
drive
the
conversation
where
you
see
a
need
for
change
or
seek
help
for
your
calico
journey
from
the
developers
who
are
actively
working
on
the
project.
A
A
A
Bios
starts
to
check
the
hardware,
then
attempts
to
boot
the
bootloader
the
bootloader
program
at
this
point
does
a
lot
of
magic
to
decompress
and
load
the
kernel
into
the
memory.
Long
story
short.
If
all
magical
things
happen.
As
expected,
you
will
end
up
with
a
running
kernel
that
provides
access
to
the
underlying
hardware.
A
If
the
underlying
cause
of
application
on
responsiveness
is
not
treated,
it
might
lead
into
a
kernel
panic
in
the
future
and
bring
the
whole
system
down
by
the
way.
Speaking
from
the
experience,
there's
a
huge
chance
that
you
are
thinking
about
a
new
problem
in
your
environment
that
just
happened,
and
if
you
don't
have
a
monitoring
or
observability
solution,
there's
a
huge
chance
that
it's
a
recurring
problem
that
have
happened
before,
but
it
was
missed
because
there's
no
luck.
A
Tech
support
in
the
british
comedy
tv
show
itcrad
used
to
say
a
phrase
that
we
all
have
heard
that
once
in
our
lifetime,
although
it
was
used
as
a
joke
by
the
tv
show
writers.
This
is
a
real
fix
in
many
situations.
A
At
this
point,
you
might
be
wondering
it
can't
be
that
simple.
Well,
it
is
that
simple.
However,
there
is
a
huge
problem
with
this
approach
after
restarting
or
sending
a
kill
signal,
you
might
destroy
critical
informations
that
could
help
you
in
diagnosing
and
finding
the
root
cause
of
the
problem.
So
is
there
a
better
solution?
A
This
is
not
a
new
topic.
There
are
countless
application
like
iostats
top
ipref,
you
name
it
that
will
give
you
a
better
understanding
on
how
resources
are
consumed
in
your
environment.
A
A
You
can
see
the
64
kilobit
kilobytes
pdp-11
in
the
left
image,
while
it
was
a
pioneering
work
and
a
leap
forward
for
its
time.
The
huge
growing
demand
for
information
and
the
old
architecture
of
cspf
started
to
raise
eyebrows
by
delivering
a
poor
performance
in
your
machines.
Like
some
60
megabytes
spark
station.
A
Unfortunately,
I
could
not
find
an
image
for
some
16
megabytes,
so
you
end
up
with
the
sun
spark
station,
one
plus
in
the
middle
they
claimed
with
implementing
vpf
capturing
packets,
can
be
10
200
times
faster
than
c
than
cspf
and
applying
kernel
agents
for
discarding
unwanted
packets
can
happen
as
early
as
possible,
resulting
in
a
huge
performance
gain
today.
Bpf
offers
way
more
than
just
capturing
packets
and
filtering
it.
A
A
A
All
right
so
demo,
full
disclosure.
There
are
some
interesting
projects
written
with
the
ppf
that
other
people
have
written
and
maintaining
them.
Please
check
out
their
github
pages.
The
links
are
provided
at
the
end
of
this
slide.
I'm
just
a
messenger
here
all
right,
so
I
have
a
kubernetes
cluster.
Hopefully,
yes,
my
cluster
runs
calico
and
it
uses
ebpf
data
plane.
A
A
This
is
the
bpf
program
and
all
its
glory,
it
will
show
you
arp
arp
table
row
table
nat
table
now.
The
things
that
I
wanted
to
see
was
the
bpf
routing
table
which
you
can
see
here.
This
is
different
from
the
linux
routing
table
and
it
is
also.
A
A
bpf
program
that
runs
inside
the
kernel,
you
can
also
check
out
the
nat
table
and
these
are
the
live
nets
that
are
happening
inside
my
cluster.
A
A
Don't
worry
if
you
don't
know
about
flame
graph,
I
didn't
know
about
it:
either.
Just
searched
inside
youtube
for
brandon
garek
he's
the
one
who
I
believe,
popularized
the
flame
breath
and
he's
also
the
maintainer
of
it.
So
he
got
like
a
lot
of
materials
about
the
profiling
and
all
the
good
stuff.
A
You
will
find,
where
is.
A
A
A
All
right,
as
you
can
see,
the
flame
graph
is
done
all
right
now
after
this,
I
thought
all
right.
This
is
great,
but
I
want
to
create
something
on
my
own.
What
are
is
there
any
project
that
can
help
me
to
like
write
my
own
bpf
codes
and
let
me
introduce
you
to
the
bpf
compiler
collection,
a
framework
that
can
help
you
write
and
execute
ppf
programs
and
tie
it
to
a
python
interpreter.
A
I
will
share
a
link
at
the
end
to
see
how
you
can
do
it
on
your
own,
as
you
can
see,
there's
not
much
running
in
this
spot
and
we
don't
see
any
other
processes
like
the
server
processes
that
is
running
inside
the
front
and
pod
application.
A
Now,
if
I
use
the
ebpf
the
bpf
profiler
and
ask
it
to
give
me
a
profile
of
the
things
that
are
running
inside
this,
my
note,
it
will
give
you
all
the
information
and
processes
that
are
running.
On
my
note.
A
So
if
I
say
I
want
to
see
my
server
application,
which
is
the
binary
that
is
serving
the
frontend
application
you
will
see,
there
is
the
there
are.
These
function,
calls
that
are
happening
inside
the
program
and
these
syscalls
that
are
happening
inside
the
kernel.
A
A
A
Although
bpf
programs
are
written
in
c,
as
I
said,
bcc
will
help
you
to
tie
them
to
a
python
frontend,
which
makes
it
easier.
So
you
could
actually
take
the
c
portion
of
these
applications
and
change
the
outputs
into
something
that
works
only
that
works
for
your
scenario
and
hopefully
share
it
with
others.
A
A
Bpf
can
help
with
tracing
and
profiling,
as
we
just
saw,
but
that
is
not
the
only
use
of
it.
Bpf
can
be
tamed
to
drive
highly
optimized
and
blazing
fast
net
for
communication
as
an
example,
calico
ebpf
data
plane
or
it
could
be
used
for
security
purposes.
A
A
A
A
These
are
the
resources
that
I
used
for
this
presentation
and
at
the
bottom
you
can
see
the
original
bpf
paper.
That
is
really
a
good
read.
I
really
recommend
it
now
that
you
find
this
recording
interesting.
I
would
like
to
mention,
there's
also
a
free
ebp,
of
course,
in
academy.tigera.org.