Skip to main content

​
What is eBPF?

eBPF (extended Berkeley Packet Filter) is a revolutionary Linux kernel technology that allows running custom programs inside the kernel without changing kernel source code or loading kernel modules.

​
How kguardian Uses eBPF

kguardian attaches eBPF programs to kernel hooks to observe pod behavior:

​
Network Traffic Monitoring

Hook points:
  • fentry/tcp_set_state - TCP connection lifecycle (both inbound and outbound)
  • kprobe/kretprobe on inet_csk_accept - Inbound TCP connections
  • fentry/udp_sendmsg - Outbound UDP traffic
Captured data:
  • Source and destination IP addresses
  • Source and destination ports
  • Protocol (TCP/UDP)
  • Network namespace (to map to containers)
Inbound UDP is not captured — there is no probe for UDP receive. Traffic arriving at a pod over UDP (e.g. DNS queries reaching CoreDNS) will not appear in the flow stream. Egress UDP and all TCP directions are tracked normally.

​
Syscall Monitoring

Hook points:
  • tracepoint/raw_syscalls/sys_enter - Entry to any syscall
Captured data:
  • Syscall number, resolved to a name (e.g., open, read, socket) in userspace
  • Process ID and container namespace
  • Node architecture (x86_64 or aarch64)

​
Why eBPF?

Performance

In-kernel tracing avoids the per-request cost of proxy-based solutions

Safety

Verifier ensures programs can’t crash the kernel

No Changes Required

No code changes, sidecars, or pod restarts needed

Kernel-Level Visibility

Connection metadata (endpoints, ports, protocol) is visible even for encrypted traffic — payloads are never captured
Learn more: