Kernel analysis with bpftrace

Linux eBPF tracing tools, showing static and dynamic tracing with extended BPF and the open source BCC collection of tools.

This blog post shows how to use bpftrace

A few months ago, I found myself wondering how a command like ping 1.1.1.1 works from within a private network. In most private networks, multiple hosts connect to the Internet through a router. For IPv4, the router performs network address translation (NAT) by rewriting the original host’s source address to the router’s public IP address. The router can lookup the correct host for a reply packet based on the packet’s port field, at least for protocols like TCP and UDP.