Blog
Thoughts on engineering, design, and building great products.
Capstone: Writing connmon — A Node-Wide TCP Connection Monitor
The final article: assembling everything learned into a real tool. connmon attaches a kprobe to tcp_connect in the kernel, pushes every new TCP connection through a ring buffer, and a Go loader prints them in real time — pid, process, destination IP:port. Just over a hundred lines, a single static binary, run it on the cluster and immediately see coredns, kubelet, curl connecting out. Includes a real kprobe build trap. Then a look back over the whole eBPF journey from scratch.
cilium/ebpf: Loading eBPF From Go
Article 9 built execsnoop in C with libbpf. This post rewrites the exact same tool but loads it from Go with the cilium/ebpf library — how the Kubernetes ecosystem (Cilium, Tetragon, Falco) builds eBPF applications. The kernel side is unchanged; bpf2go compiles it and embeds the object straight into the Go code, then a Go program attaches the tracepoint and reads the ring buffer. The result is a single static binary with no dependency on libbpf.so — and we hit the real traps building it.