Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
Writing an eBPF Protocol Tracer on Linux in 2026: Why the Verifier Wants Your Parser in Userspace
The verifier rejects a parsing loop because it cannot bound a trip count read from user memory, and that is design feedback rather than an obstacle. Compares bpftrace, BCC, libbpf and yeet, then covers back-edge errors, the 512-byte stack limit, per-CPU scratch maps, request/reply correlation and CO-RE field renames across kernels.
bpftrace vs BCC in 2026: Which One to Start Your eBPF Project With
Start with bpftrace unless your project already needs flags, floating-point math, or hosts with no compiler on them, in which case start with BCC. A side-by-side review of what each one installs, what each one refuses to do, the 512-byte stack limit that ends a bpftrace script, and how to tell today which one you will outgrow.