Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Monitor HTTP Traffic on Linux in 2026: What the Kernel Sees That Your Proxy Doesn't
A sidecar proxy sees the traffic you routed through it. The kernel's TC layer sees what actually crossed the wire, including loopback, without anything being rerouted. Compares OpenTelemetry, Envoy, tcpdump, Pixie, Cilium Hubble and httpwatch, and how to pick the one that answers your question.
eBPFobservabilityHTTPkuberneteslinuxtcpdump
Read more →eBPF-Speed L7 Enforcement Without a CNI Migration
Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.
eBPFkubernetesnetworkingCilium
Read more →