Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

All eBPF4 linux3 observability3 HTTP2 kubernetes2 networking2 tcpdump2 802.111 Cilium1 rf1 wifi1 wireless1 yeet1

August 14, 2026

How to Monitor HTTP Traffic on Linux in 2026: Why the Kernel Sees What Your Access Log Doesn't

How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.

eBPFobservabilityHTTPnetworkinglinuxtcpdump

August 12, 2026

eBPF-Speed L7 Enforcement Without a CNI Migration

Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.

eBPFkubernetesnetworkingCilium