Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
Which Process Is Talking to Which Host? (Linux 2026)
ss shows you sockets that exist right now and tcpdump shows you packets with no process attached. To answer which process is talking to which host, you need the connection caught at the moment it is dialed, in the context of the process that dialed it. Here is how to do that on Linux, and when a bpftrace one-liner is the better call.
How to Let an AI Agent Troubleshoot Your Network on Linux in 2026: Give It the Wire, Not the Dashboard
Agentic NetOps products from NetBrain, Cisco and Selector reason over telemetry a device already exported, and a Wireshark MCP server needs a capture that was running when the failure hit. Here is what an agent has to be able to read to find a reset, a stale DNS answer or a failed handshake on a Linux host, and how yeet lets it read the wire from the kernel without a shell or root.
How Do I Prove a Network Problem Isn't on Our Side? (2026)
Every cross-team incident reaches the same deadlock: two sides with dashboards that disagree and no shared evidence. The packets settle it. Here is what actually counts as proof on Linux, how to show which side closed the connection first, and how to capture what a third-party endpoint really sent back.
Who Is Resetting My TCP Connections on Linux? (2026)
Every guide to connection reset by peer ends at the same place: run tcpdump and read the source address of the RST. That gives you an IP, not a cause. Here is how to find which process owned the reset socket on Linux, tell a peer reset apart from a kernel one, and watch resets live without a capture file.
Why Is My TLS Handshake Failing on Linux? (2026)
A TLS handshake fails before your application logs anything useful, which is why the error you get is generic and the cause is not. The negotiation itself is cleartext on the wire, including the hostname your client sent and the alert that ended it. Here is how to read both on Linux without the private key and without restarting the process.
How to Capture Packets on wg0 and Other Tunnel Interfaces on Linux: The Ethernet Header Is Not Missing, It Was Never There
Capturing on wg0, gre1 or tun0 hands you a bare IP packet, because a raw-IP tunnel device has no MAC header to give you; pktscope is a terminal packet analyzer whose TCX eBPF tap starts the snap at the MAC header on Ethernet-framed devices and at the network header on tunnels, so the decode and the hex offsets match the device you picked.
How to Monitor HTTP Traffic on Linux in 2026: Why the Kernel Sees What Your Access Log Doesn't
How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.
eBPF-Speed L7 Enforcement Without a CNI Migration
Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.