## Accelerate Service Mesh Network with ebpf Luyao Zhong ## Agenda • TCP/IP stack overhead in service mesh • Background knowledge of eBPF - Independent solution to bypass TCP/IP stack • Performance jpg) ## ebpf Background Knowledge ## Loader & Verification Architecture  https://ebpf.io/what-is-ebpf/ ## ebpf Background Background Knowledge map • Share collected information • Accessed from eBPF programs as well as from applications in user space • Map type O HASHMAP O SOCKHASH: Hold socket as value Istio Meetup China

## eBPF Summit October 28, 2020 ## Debugging Go in production using eBPF  i'm Zain  What are we going com/pixie-labs/pixie https://blog.pixielabs.ai/ebpf ## Some related projects https://github.com/kinvolk/inspector-gadget sysdig https://github.com/draios/sysdig/wiki/eBPF

## Traffic Control the Rabbit(MQ) with Rust using RedBPF eBPF Summit ## I n This Talk • Different “types” of BPF programs • Write BPF programs in Rust • Add new feature in RedBPF • Use BPF maps to

## Accelerate Istio-CNI with ebpf Xu Yizhou & Guo Ruijing ## Agenda • Istio-CNI • tcp/ip stack overhead between sidecar and service • Background knowledge of ebpf • Acceleration for Inbound/Outbound/Envoy [Image](/uploads/documents/5/a/b/b/5abb1b8f1b8f9d74adba9f84c56cea7a/p5_1.jpg) ## ebpf Background Knowledge ## Prog type • ebpf provide various programs type for different purpose - We choose SOCK_OPS & BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, } ## ebpf Background Knowledge ## map - Share collected information and to store state • Accessed from eBPF programs as well as from applications in user space

## eBPF at LINE's Private Cloud eBPF Summit ## LINE • Messaging & many family services • 185 million global MAU • 3Tbps+ network traffic in total ## LINE ![Image](/uploads/documents/4/7/

Simple Precise Process Confinement with eBPF and KRSI eBPF Summit ## bpfbox at a Glance ▶ bpfbox is a novel process confinement mechanism for Linux using eBPF ▶ Users write per-application policy in a/7/c/ba7c57cbfa53ff2a90045cb7d548fb18/p3_4.jpg) TOMOYO ▶ Can we do any better? ## eBPF Changes the Game eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints ▶ Under 2000 source lines of kernelspace code Thanks to eBPF, bpfbox is light-weight, flexible, and production-safe

## Zero instrumentation monitoring with your first steps in eBPF eBPF Summit ## What will we be doing?  ## How are we going  ## Conclusions • eBPF programs can be attached to different events: ☐ Kprobes ☐ uprobes Tracepoints ☐ network packets [Image](/uploads/documents/6/7/f/b/67fb97f40f52a63942230afc50af9547/p7_1.jpg) https://github.com/b3a-dev/ebpf-geoip-demo ## Let's represent the attendees in the map! $curl 34.70.147.68:8083 ![Image](/

## Can eBPF save us from the Data Deluge? A case for file filtering in eBPF eBPF Summit ## The data deluge on modern storage Compute node Storage node CPU Network Flash | | | | ## The data deluge research group • Work with eBPF ## whoami • Giulia Frascaria • PhD student in Vrije Universiteit Amsterdam - atLarge research group • Work with eBPF for storage! ## eBPF and DoS Compute node Storage Storage node CPU Network | | | | Flash ## eBPF and DoS Compute node Storage node CPU DoS Flash ## eBPF and DoS Compute node Storage node CPU DoS Flash ## DoS in reverse! Compute node Storage

Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent eBPF Summit ## I ntroduction ● Wide variety of eBPF use cases (logging, CPU over overhead) • Today: ☐ Network [Image](/uploads/documents/c/7/4/d/c74d82edc22d50cbdea681f7475bb901/p3_2.jpg) ## One of the solutions eBPF + Cilium • Export the data to Splunk • Define signatures   ## eBPF Q&A on the Slack channel :)

## Enabling eBPF Super Powers on ARM64 with Cilium Jianlin Lv eBPF Summit finleap ## Preface  ![Image](/uploads/docu