Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Powered by
Title
s
seph
04/25/2018, 7:02 PM
https://github.com/capsule8/capsule8/blob/master/docs/KProbes.md
looks like the simple intro. It's based on kprobes. Additionally leverages cgroups so you can instrument differently at different processes.
m
maestretti
04/25/2018, 11:14 PM
As I recall it uses standard perf techniques instead of ebpf so broader kernel support but not as performant (more context switches etc).
s
seph
04/25/2018, 11:22 PM
Uses kprobes. My coworkers think it's performant.
b
b0l
04/30/2018, 7:03 PM
yes, it uses kprobes and perf_event_open to get data from kernel ring buffer.
7 Views
#ebpf
Join Slack