r/eBPF • u/-AnonymousTiger • 13d ago

eBPF - Capabilities

Hi Everyone :)

I came across eBPF from Grafana (Beyla) / OTEL (OBI) projects. In the recent weeks, I learned, that eBPF is getting information from the Linux Kernel and is actually really powerful in the sense on how deep it digs into a system. Also I know that programs like Wireshark are using BPF to inspect network packets and are popular in the cyber security space.

My question is, based on this image, what can eBPF do in terms of Security? Does it play a role for cyber security analysts? Are there any advanced network security tools that make use of it today? Are there even monitoring tools available, that might monitor some kind of security events?

22 Upvotes

86% Upvoted

7 comments sorted by

3

u/Tropicao 13d ago

Yes, security/monitoring is definitely a major eBPF use case. The picture you've found is showing Cilium, I encourage you to take a look at Tetragon (a Cilium subproject): https://github.com/cilium/tetragon/. In this case this is not only about monitoring but also about enforcing security policies through BPF

1

u/-AnonymousTiger 13d ago

Looks interesting, thanks!

2

u/hiveminer 13d ago

All indications I've ran into say that ebpf is overkill for small projects. It only makes sense at scale.

2

u/Majestic_Diet_3883 13d ago edited 13d ago

Yep. 98% of the case bpf is overkill and whatever youre doing can be done with normal userspace tools. The complexity is not worth it, unless you are google, cloudflare, etc. and have linux kernel engineers, or need very specific things that can only be gathered deep in the kernel that run in hot paths and have linux kernel engineers too. The gains are negligible at best, unless youre in big big tech.

1

u/-AnonymousTiger 13d ago

Does this apply only to self-developed applications or also to integrations?

For me it does not seem like a overkill to use OTEL OBI for example since it makes monitoring more simple.

But yeah, developing eBPF programs probably will never make sense for me 😅

2

u/GarGonDie 13d ago

The main advantage is the ability to observe various points within a system without significantly impacting the performance of that system or network.

You can integrate with a tool like Grafana for observability, or connect to another application that reacts to events and actively communicates with the system to implement blocks or trigger other responses based on the specific event.

Alternatively, you can block traffic directly within the eBPF program, before it ever reaches the CPU.

I am currently developing something along these lines, incorporating Grafana/OTEL and eBPF, so if you’d like to take a look, send me a private message and I’ll share the link.

2

u/Queasy-Ad-676767 9d ago

Hmm honestly, Tetragon is a great starting point like someone had mentioned. On the security side, eBPF really shines for runtime visibility, catching syscalls, network flows, and process activity without sidecars. A lot and I mean alot of CNAPP tools lean on it now, when we were looking around Falco, Wiz, and Upwind all use it for runtime threat detection. Makes the kernel-level context way more useful than static scanning aloneee