Tracing Mystery Network Traffic with eBPF Across HRT's Global Compute Cluster

This is a very nice use of eBPF and probably close to the imagined scenario the kernel developers proposed for this.

eBPF has a terrible name but it's absolutely wonderful tech. If you're running a database SaaS you can implement eBPF filters to do the accounting for billing based usage, regardless of which database you use!

To me that's irrefutable evidence that it's really well designed

https://youtu.be/Wb_vD3XZYOA The minidoc on eBPF is worth a watch if OP/OC excites :)

Not familiar with NFS, but shouldn't it have been possible to attribute the mystery traffic by port number by sniffing ?

Simply graphing netflow data would also have immediately pointed out an error.

The high volume site-to-site data transfers for running simulation etc reminds me strongly of the high energy physics computing world. no wonder so many HEP folks ended up at HRT!