Author Description

Mastering eBPF for Linux Observability and Security A Hands-On Guide for Beginners, DevOps, SREs, and Security Engineers to Build High-Performance eBPF Programs for Tracing, Monitoring, and Firewalls Unlock the full power of eBPF (Extended Berkeley Packet Filter) and take control of your Linux system’s observability, tracing, and runtime security—all without modifying the kernel. Whether you're a DevOps engineer, SRE, beginner system programmer, or a cybersecurity professional, this book delivers the real-world eBPF skills you need to build high-performance tools for network monitoring, system tracing, intrusion detection, and firewall enforcement. Written in 2025 to reflect the most up-to-date trends, kernel features, and development tools, this practical guide walks you through working eBPF programs—from writing your first tracepoint hook to deploying advanced XDP-based packet filters and Grafana-powered dashboards. You’ll learn how to write efficient, safe, and portable eBPF code using both BCC and libbpf, while understanding CO-RE, perf, bpftool, BPF maps, verifier errors, and more. This isn’t a theoretical overview. It’s a deeply practical, beginner-friendly book with complete and executable code for custom syscall tracers, TCP connection monitors, file integrity checkers, and runtime firewall logic—all built from the ground up. Whether you're optimizing performance or securing cloud-native infrastructure, this book ensures you understand why and how each piece works. What makes this book different? Complete, well-explained, production-grade code examples Up-to-date coverage of modern eBPF tools, XDP, CO-RE, and bpftool Designed to accelerate learning for both newcomers and working engineers Written with clarity, precision, and purpose—every line adds value About the Author Robert Austin is a seasoned Linux engineer and systems author known for simplifying complex technologies for modern developers and DevOps