A simple BPFTrace to see TCP SendBytes as a Histogram

Rakesh M
2 min readNov 26, 2022

A significant difference between BCC and BPF is that BCC is used for complex analysis while BPF programs are mostly one-liners and are ad-hoc based. BPFTrace is an open-source tracer, reference below

https://ebpf.io/ — Excellent introduction to EBPF

https://github.com/iovisor/bpftrace — Excellent Resource.

Let me keep this short, we will try to use BPFTrace and capture TCP

we will need

  1. Netcat
  2. DD for generating a…

--

--