eBPF Questions

A Cilium operator notices that on a particular cluster node running an older kernel, some eBPF-based features like socket-level load balancing are una...

An eBPF program must be attached to a hook point in the kernel to run. Which hook point does Cilium primarily use to intercept and process ingress and...

Which Linux kernel subsystem is eBPF most directly associated with, enabling it to safely run custom bytecode inside the kernel?

A networking team asks why Cilium with eBPF performs better than a traditional iptables-based CNI at large scale. Which characteristic of eBPF-based p...

A security engineer argues that eBPF programs loaded by Cilium could be used to exfiltrate kernel data or crash the node. Which kernel mechanism speci...

What is the benefit of Cilium's east-west load balancing rewriting service connections at the connect call?

Which feature set is documented for Cilium north-south load balancing?

Which statement best captures the advantage Cilium gains from eBPF over traditional IP-based filtering?

How does Cilium handle newer eBPF capabilities that may or may not exist on a given Linux kernel?

Beyond packet filtering, which additional data structures does the component overview say eBPF has been extended with?

In the Cilium datapath objects described in the eBPF introduction, which object performs a map lookup on destination IP and optionally destination por...

Which BPF hook gives Cilium the earliest possible packet-processing point in the driver and is ideal for high-performance filtering?

A local TCP connection between two Cilium-managed endpoints on the same node should be redirected quickly after policy validation instead of taking th...

A security team wants to drop packets for obviously invalid destinations before they travel further through the stack. Which Cilium datapath object be...

Which hook does Cilium use to monitor TCP state transitions, especially when a connection reaches ESTABLISHED, so it can attach accelerated socket pro...