Networking

Diagram of the eBPF verifier, JIT, and hook points inside the Linux kernel.

Inside eBPF: How the Linux Kernel Runs Sandboxed Programs Inside Itself

TL;DR — eBPF lets you load and run sandboxed bytecode inside the Linux kernel at near-native speed, attached to hooks like network events, syscalls, and tracepoints. A static verifier guarantees the program terminates and stays safe before a JIT compiler turns it into machine code, which is why tools like Cilium, Pixie, and bpftrace have reshaped observability and networking in production. If you’ve shipped a service on Linux in the last five years, you’ve almost certainly been touched by eBPF — even if you never wrote a program yourself. Cilium powers the networking and service mesh layer for hyperscalers like AWS and Shopify. Datadog and New Relic ship kernel probes for zero-instrumentation tracing. Cloudflare uses eBPF to do connection tracking and DDoS mitigation at line rate. The reason this is possible is a piece of kernel machinery that turns “the kernel is a closed black box” into “the kernel is a programmable, observable, auditable system,” without compromising its stability. ...

Network packets flowing through an eBPF/XDP datapath diagram.

Building an eBPF-Powered Packet Classifier in C: A CV-Worthy Systems Project

Build a production-shaped eBPF/XDP packet classifier from scratch in C. Real code, real architecture, and a clear roadmap to extend it into a senior-level systems project.

Network packets traveling along a glowing path representing a TLS 1.3 0-RTT handshake.

Inside TLS 1.3 Zero Round-Trip Resumption: Architecture, Trade-Offs, and Production Deployment

How TLS 1.3 0-RTT cuts handshake latency to a single round trip — and the replay, forward-secrecy, and operational trade-offs you need to understand before turning it on.

Abstract representation of encrypted network traffic and connection resumption between client and server.

Implementing TLS 1.3 Zero Round-Trip Resumption: Mechanisms, Pitfalls, and Production Deployment

How TLS 1.3 0-RTT resumption actually works on the wire, why replay attacks make it risky for non-idempotent requests, and the patterns real teams use to deploy it safely behind NGINX, Envoy, and HAProxy.

Diagram of a TCP flow with bottleneck link and BBR pacing.

Optimizing TCP BBR Congestion Control: A Deep Dive into Production Deployment

How BBR actually estimates bottleneck bandwidth and RTT, why v2/v3 fix v1’s loss-insensitivity, and what to tune at the kernel, application, and NIC layers before you ship it.