Lion Cipher Lab
Trace your Linux system with eBPF and bpftrace (see every exec, open, and connection)
- Cyber / Security Engineer
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Almost every modern piece of runtime security — Falco, Cilium/Tetragon, and the sensors inside commercial EDR — watches the kernel with eBPF, because it is the one way to see everything a machine does (every program launched, every file opened, every connection made) without the crippling overhead of the older approaches. bpftrace is the fastest way to touch that power directly: a few lines and you are reading the kernel live. The durable skill is not the syntax, it is the judgment underneath it — knowing that eBPF gives you low-overhead, system-wide, programmable visibility, when that beats…
What you'll learn
- what eBPF is (a safe in-kernel VM running sandboxed programs on kernel/user events)
- reading probe types: tracepoint, kprobe, uprobe
- listing probes with bpftrace -l
- tracing process execution, file opens, and syscalls with one-liners
- observing new TCP connections from the kernel
- writing and running a multi-line .bt script
- judging when eBPF beats auditd and strace — and when NOT to use it
Steps in this lab
- What eBPF and bpftrace actually are
- When eBPF beats the alternatives — the judgment
- Get a kernel that can actually run this
- Install bpftrace and list the probes on your kernel
- Trace every program that runs (the exec firehose)
- Trace file opens, then count syscalls per process
- Watch new outbound TCP connections
- Write a real .bt script and run it
- Why this matters for security — and when NOT to use it