Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How Do I Get an AI Agent to Debug My API? (2026)
Your agent can read your code and your logs, which is why it keeps guessing. Give it the traffic instead: every request and response the machine actually sent, read from the kernel, and the agent follows the failure into the network rather than reasoning about what should have happened.
How Do I Detect API Drift After a Deploy? (2026)
A field disappears from a response, an id changes from a number to a string, and nothing errors. The provider is fine, your service is fine, and only the strictest client breaks. Here is how to catch API drift on Linux by learning each endpoint's shape from live traffic and reporting what changed.
How to Monitor HTTP Traffic on Linux in 2026: What the Kernel Sees That Your Proxy Doesn't
A sidecar proxy sees the traffic you routed through it. The kernel's TC layer sees what actually crossed the wire, including loopback, without anything being rerouted. Compares OpenTelemetry, Envoy, tcpdump, Pixie, Cilium Hubble and httpwatch, and how to pick the one that answers your question.
How to Monitor HTTP Traffic on Linux in 2026: Why the Kernel Sees What Your Access Log Doesn't
How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.