Appendix C - Recommended Reading & Tools
The book is a living document and so is this appendix. Everything listed here either appears in the chapters or fills the gaps the chapters leave open on purpose.
The kernel, first hand
- The Linux kernel source,
net/andkernel/bpf/in particular. Readnet/core/dev.c(the packet path of Chapter 1),net/ipv4/tcp_input.c(the receive path of Chapter 7),net/core/sock_map.c(Chapter 8) andkernel/bpf/verifier.c(Chapter 2 - take it slowly). Nothing replaces it. - BPF and XDP Reference Guide (Cilium docs). The canonical hook-by-hook reference; Chapters 5-6 and 10-12 are its practical shadow.
- kernel.org docs:
Documentation/bpf/for the instruction set, verifier, and CO-RE/BTF.
Books and papers
- Linux Kernel Networking: Implementation and Theory (Rosen) - the protocol internals behind Chapter 7.
- BPF Performance Tools (Gregg) - the tracing playbook behind Chapters 7, 13 and 15, with the perf numbers to steal.
- Systems Performance (Gregg) - the methodology: USE method, off-CPU analysis, and the latency ladder of Appendix B.
- TCP/IP Illustrated, Volume 1 (Stevens) - the protocol model; still the clearest statement of how TCP actually behaves.
- The Cilium documentation and the Cilium: BPF and XDP Reference Guide
- the production data path of Chapters 10-12, with the real programs (written in C, read them alongside the Rust of this book).
Tools you should install
| Tool | Why |
|---|---|
bpftool | inspect programs, maps, and BTF; the debugger of Chapters 2 and 14 |
bpftrace | one-liners for tracing; the fastest way to confirm a model |
bpf-linker + rust-bpf target | the Aya build chain of Chapter 3 |
aya / aya-bpf crates | the libraries the whole book is built on |
tcpdump / tshark | see the packets, check the parse logic |
tc, ip (iproute2) | attach and inspect tc hooks (Chapter 6) |
perf | kernel profiling and the call chains of Chapter 13 |
kind + kubectl | the local cluster of Part IV and the capstone |
cilium-cli | install Cilium and run Hubble (Chapters 11-12) |
Where to follow the ecosystem
- Aya project (
aya-rs) - Rust eBPF; docs, examples, and theaya-examplesrepository that the code companions of this book build on. - Cilium - the reference deployment; watch its design documents for the datapath decisions explained in Chapters 10-12.
- bpf-next mailing list and the BPF kernel docs - where the hooks you
use are designed; the
bpfsubsystem moves fast and the list is where the future of Chapters 13-15 is being written.
A final note on versions: eBPF moves quickly. When a number in this book disagrees with your kernel, trust the kernel - and tell us, so the book can catch up.