Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF60linux60yeet57AI agents30observability21networking12security10claude-code7containers5sandboxing5HTTP4production4tcpdump4tracing4uprobes4API debugging3bcc3bpftrace3ci3debugging3egress3exectop3incident-response3kubernetes3omarchy3supply chain3TLS3troubleshooting3audit2auditd2BSON2capabilities2cgroups2codex2databases2DNS2execsnoop2hyprland2MongoDB2mysql2oom2packet-capture2performance2permissions2postgres2processes2quickshell2runtime-debugging2ssh2TCP2802.111agent-security1agentic network operations1ai-sre1bar-widget1benchmarks1biolatency1bpf-verifier1bubblewrap1build-performance1Cilium1CO-RE1confidential-computing1context-switches1cpu-accounting1cryptojacking1devops1docker1exfiltration1hardening1integration-testing1kprobes1kworker1landlock1latency1local-llm1logging1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1openssl1opentelemetry1plugin1policy1postinstall1prepared statements1privilege1proc-filesystem1process-attribution1process-masquerading1proctop1profiling1query-shapes1Redis1refusal1RESP1rf1root-cause-analysis1runqlat1schedstat1seccomp1slowlog1SQLite1SSRF1stratum1sudo1syscall1systemd1tcp-retransmits1terminal-bench1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1yeetkit1+123 more

All eBPF60 linux60 yeet57 AI agents30 observability21 networking12 security10 claude-code7 containers5 sandboxing5 HTTP4 production4 tcpdump4 tracing4 uprobes4 API debugging3 bcc3 bpftrace3 ci3 debugging3 egress3 exectop3 incident-response3 kubernetes3 omarchy3 supply chain3 TLS3 troubleshooting3 audit2 auditd2 BSON2 capabilities2 cgroups2 codex2 databases2 DNS2 execsnoop2 hyprland2 MongoDB2 mysql2 oom2 packet-capture2 performance2 permissions2 postgres2 processes2 quickshell2 runtime-debugging2 ssh2 TCP2 802.111 agent-security1 agentic network operations1 ai-sre1 bar-widget1 benchmarks1 biolatency1 bpf-verifier1 bubblewrap1 build-performance1 Cilium1 CO-RE1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 devops1 docker1 exfiltration1 hardening1 integration-testing1 kprobes1 kworker1 landlock1 latency1 local-llm1 logging1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 openssl1 opentelemetry1 plugin1 policy1 postinstall1 prepared statements1 privilege1 proc-filesystem1 process-attribution1 process-masquerading1 proctop1 profiling1 query-shapes1 Redis1 refusal1 RESP1 rf1 root-cause-analysis1 runqlat1 schedstat1 seccomp1 slowlog1 SQLite1 SSRF1 stratum1 sudo1 syscall1 systemd1 tcp-retransmits1 terminal-bench1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1 yeetkit1

October 23, 2026

How Do AI Agents Capture and Parse Linux Network Packets? (2026)

tcpdump captures fine and hands you a binary file an agent cannot reason about without a parser. How to decode in the capture path instead, so protocol, ports and fields like a TLS SNI arrive structured, and the limits: no reassembly, no pcap export, HTTPS payloads stay ciphertext.

AI agentspacket capturetcpdumpeBPFnetworkinglinuxyeet

August 24, 2026

How to Capture Packets on wg0 and Other Tunnel Interfaces on Linux: The Ethernet Header Is Not Missing, It Was Never There

Capturing on wg0, gre1 or tun0 hands you a bare IP packet, because a raw-IP tunnel device has no MAC header to give you; pktscope is a terminal packet analyzer whose TCX eBPF tap starts the snap at the MAC header on Ethernet-framed devices and at the network header on tunnels, so the decode and the hex offsets match the device you picked.

tunnelswireguardpacket-capturetcpdumpeBPFlinuxnetworkingyeet