Linux 内核 eBPF 网络可观测性实战：从零编写 XDP 程序到生产级流量分析

Introduction

eBPF (Extended Berkeley Packet Filter) has revolutionized how we observe, trace, and secure Linux systems. Originally designed for packet filtering, eBPF now powers everything from high-performance networking to security enforcement — all without modifying kernel source or loading kernel modules.

How eBPF Works: The Kernel Virtual Machine

eBPF programs are written in restricted C, compiled to eBPF bytecode, and verified by the kernel's safety checker before JIT-compilation to native instructions. The verifier ensures programs cannot crash the kernel, loop indefinitely, or access invalid memory.

Network Hook Points: XDP, TC, and Socket-Level

eBPF programs attach to multiple network layers:

• XDP (eXpress Data Path): Directly attached to NIC driver, executing before kernel network stack — millions of packets per second per core
• TC (Traffic Control): Attaches to kernel traffic control layer, enabling ingress/egress filtering with full sk_buff access
• Socket/sock_ops: Socket operation-level connection visibility
• kprobes/tracepoints: Dynamic tracing of kernel network functions like tcp_sendmsg and tcp_rcv_established

Code Example: Connection Tracker with eBPF Map

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10240);
    __type(key, struct sock *);
    __type(value, u64);
} conn_start SEC(".maps");

SEC("kprobe/tcp_v4_connect")
int trace_connect(struct pt_regs *ctx) {
    struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx);
    u64 ts = bpf_ktime_get_ns();
    bpf_map_update_elem(&conn_start, &sk, &ts, BPF_ANY);
    return 0;
}

eBPF vs Traditional Approaches

Compared to kernel modules: guaranteed safety via verifier, zero compilation during deployment, universal portability via CO-RE. Compared to tcpdump/Wireshark: eBPF provides in-kernel aggregation reducing data volume by 1000x.

Observability Toolchain

• BCC (BPF Compiler Collection): Python/Lua frontend, rapid prototyping, rich pre-built tools like tcplife
• libbpf: C library for production eBPF applications, CO-RE support
• bpftrace: High-level tracing language for ad-hoc analysis

Production Deployment Patterns

1. Always-on agents: Lightweight eBPF exporters feeding Prometheus metrics (Pixie, Cilium Hubble)
2. Incident diagnosis: On-demand eBPF programs via bpftrace one-liners
3. Security monitoring: Falco uses eBPF for runtime threat detection
4. Traffic engineering: Katran using XDP for high-performance L4 load balancing

The Future: eBPF for Service Mesh

eBPF is replacing iptables/CNI-based networking in Kubernetes (Cilium), enabling identity-aware network policy. eBPF-terminated proxies promise sidecar-less service mesh architectures.

Conclusion

eBPF has evolved from a packet filter into the most powerful instrumentation mechanism in Linux networking. Mastering eBPF is essential for infrastructure engineers at scale.