eBPF

May 7, 2026

How Cloudflare responded to the Copy Fail Linux vulnerability

When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.

March 31, 2026

Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers

Magic Transit customers can now program their own DDoS mitigation logic and deploy it across Cloudflares global network. This enables precise, stateful mitigation for custom and proprietary UDP protocols.

October 21, 2025

A deep dive into BPF LPM trie performance and optimization

This post explores the performance of BPF LPM tries, a critical data structure used for IP matching.

July 4, 2022

A July 4 technical reading list

Heres a short list of recent technical blog posts to give you something to read today

February 17, 2022

Production ready eBPF, or how we fixed the BSD socket API

We are open sourcing the production tooling weve built for the sk_lookup hook we contributed to the Linux kernel, called tubular

December 6, 2021

How We Used eBPF to Build Programmable Packet Filtering in Magic Firewall

By combining the power of eBPF and Nftables, Magic Firewall can mitigate sophisticated attacks on infrastructure by enforcing a positive security model.

September 18, 2020

Raking the floods: my intern project using eBPF

SYN-cookies help mitigating SYN-floods for TCP, but how can we protect services from similar attacks that use UDP? We designed an algorithm and a library to fill this gap, and its open source!

October 12, 2019

It's crowded in here!

We recently gave a presentation on Programming socket lookup with BPF at the Linux Plumbers Conference 2019 in Lisbon, Portugal.

May 18, 2019

Cloudflare architecture and how BPF eats the world

Recently at I gave a short talk titled "Linux at Cloudflare". The talk ended up being mostly about BPF. It seems, no matter the question - BPF is the answer. Here is a transcript of a slightly adjusted version of that talk.

May 3, 2019

eBPF can't count?!

It is unlikely we can tell you anything new about the extended Berkeley Packet Filter, eBPF for short, if you've read all the great man pages, docs, guides, and some of our blogs out there. But we can tell you a war story, who doesn't like those?

August 24, 2018

Introducing ebpf_exporter

Here at Cloudflare we use Prometheus to collect operational metrics. We run it on hundreds of servers and ingest millions of metrics per second to get insight into our network and provide the best possible service to our customers.

May 13, 2018

Tracing System CPU on Debian Stretch

How an innocent OS upgrade triggered a cascade of issues and forced us into tracing Linux networking internals.

March 29, 2018

eBPF, Sockets, Hop Distance and manually writing eBPF assembly

A friend gave me an interesting task: extract IP TTL values from TCP connections established by a userspace program. This seemingly simple task quickly exploded into an epic Linux system programming hack.