Demystifying eBPF - eBPF Firewall from scratch
summary
Builds a working firewall by writing eBPF C that attaches to the NIC via XDP, shows a minimal program returning XDP_PASS then switching to XDP_DROP to block all packets, and refines it to parse the Ethernet header, use BPF_htons to compare the ethertype and drop IPv6 packets. Demonstrates verifier-driven safety with explicit bounds checks on packet data, explains persistent BPF maps for cross-packet state and userland access, and highlights that running in-kernel on the NIC yields extremely fast packet filtering that actually works.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:28CNCF Projects
- 9:48Pass everything
- 11:56Drop everything
- 13:24Pseudocode (what we want)
- 16:21Drop IPv6
- 22:28Outcome
- 23:13Summary
related talks
30mA Beginner's Guide to eBPF Programming for Networking
33meBPF: exploring use case of BPF kernel infrastructure
32meBPF: BPF kernel infrastructure
47mBuilding a lightning fast Firewall with Java & eBPF
47mInto the Heart of the eBPF Hive!
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
01h 18mTutorial: Getting Started with eBPF
19mGet start with XDP: write a network filter in 10m