I once set up a FreeBSD box to do shaping for an ISP's entire DSL customer base, and it was a couple commands and worked brilliantly! By contrast, I've dabbled with Linux shaping for ~2 decades, and the best I've gotten is one recipe that works well for one limited use case. Maybe it's just me, but I've never been able to make it do my bidding, despite several occasions sitting down and giving it the old college try.
For other kernel paths, I'm really interested in using it to monitor for file modifications in the way that inotify is not very good. And I often resort to strace to figure out low level what is going on, it might be really good for that too.
Looks like an interesting book!
BPF is a double-edged sword in that regard. It's being used to write better tracing tools for normal kernel facilities, but facilities which migrate to BPF become more opaque and unstructured than ever.
Totally agree. Have had horrible experiences with inotify. I was able to modify https://github.com/iovisor/bcc/blob/master/tools/filelife.py and get a good alternative to find new files.
It still isn't polished and haven't tested it enough so will release it back to community when its ready for beta.
I'm curious to hear which use cases didn't work out for you.
Regarding BPF, is it possible to convert IPT rules to BPF for backwards compatibility?
sqm-scripts is generally a much better option than wondershaper derivatives: https://github.com/tohojo/sqm-scripts
Jumbo frames largely solve the problem, but it's the biggest hurdle we've found.
> You've mentioned that we do have BTF now in Linux 4.18. I've tried to find if it was leveraged in bpftrace, but it looks like it isn't yet.
> That's the old repo (we should add a note to it pointing people to https://github.com/iovisor/bpftrace instead!)
Alastair added struct support for kprobes yesterday, based on the functionality in bcc (which bpftrace uses). That was the final missing piece, and why I'm posting about it now. See the last example here:
I took a look and according to the last example mentioned they have not added full struct support yet.
There are eleven exclamation marks on that page.
BPF is the new paradigm for synergistic application of strategic opportunities in the use of acronyms.
Why did I get down voted? I am not affiliated with this book, the authors of the book, or the OP in anyway. It just so happens that I will find this book very useful, so I thanked the OP for sharing.
It is sad we live in a world where there is so much manipulation that we are suspicious of each other's sincerity. I guess I understand where the downvoter was coming from :-(
> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.