Cloudflare Repositories FTW
May 30, 2019 1:00 PM
Kali Linux turned six years old this year! In this time, Kali has established itself as the de-facto standard open source penetration testing platform....
Cloudflare architecture and how BPF eats the world
May 18, 2019 3:00 PM
Recently at I gave a short talk titled "Linux at Cloudflare". The talk ended up being mostly about BPF. It seems, no matter the question - BPF is the answer. Here is a transcript of a slightly adjusted version of that talk....
eBPF can't count?!
May 03, 2019 1:00 PM
It is unlikely we can tell you anything new about the extended Berkeley Packet Filter, eBPF for short, if you've read all the great man pages, docs, guides, and some of our blogs out there. But we can tell you a war story, who doesn't like those? ...
xdpcap: XDP Packet Capture
April 24, 2019 6:21 PM
Our servers process a lot of network packets, be it legitimate traffic or large denial of service attacks. To do so efficiently, we’ve embraced eXpress Data Path (XDP), a Linux kernel technology that provides a high performance mechanism for low level packet processing....
io_submit: The epoll alternative you've never heard about
January 04, 2019 11:02 AM
The Linux AIO is designed for, well, Asynchronous disk IO! Disk files are not the same thing as network sockets! Is it even possible to use the Linux AIO API with network sockets in the first place? The answer turns out to be a strong YES! ...
MORE POSTS
August 24, 2018 3:11 PM
Introducing ebpf_exporter
Here at Cloudflare we use Prometheus to collect operational metrics. We run it on hundreds of servers and ingest millions of metrics per second to get insight into our network and provide the best possible service to our customers....
- By
May 13, 2018 4:00 PM
Tracing System CPU on Debian Stretch
How an innocent OS upgrade triggered a cascade of issues and forced us into tracing Linux networking internals....
- By
April 17, 2018 10:11 PM
mmproxy - Creative Linux routing to preserve client IP addresses in L7 proxies
In previous blog post we discussed how we use the TPROXY iptables module to power Cloudflare Spectrum. With TPROXY we solved a major technical issue on the server side, and we thought we might find another use for it on the client side of our product....
- By
April 12, 2018 1:00 PM
Abusing Linux's firewall: the hack that allowed us to build Spectrum
Introducing Spectrum: a new Cloudflare feature that brings DDoS protection, load balancing, and content acceleration to any TCP-based protocol.Today we are releasing Spectrum. ...
- By
February 20, 2018 7:49 PM
Using Go as a scripting language in Linux
At Cloudflare we like Go. We use it in many in-house software projects as well as parts of bigger pipeline systems. But can we take Go to the next level and use it as a scripting language for our favourite operating system, Linux?...
- By
October 23, 2017 11:28 PM
How to Monkey-Patch the Linux Kernel
I have a weird setup. I type in Dvorak. But, when I hold ctrl or alt, my keyboard reverts to Qwerty. You see, the classic text-editing hotkeys, ctrl+Z, ctrl+X, ctrl+C, and ctrl+V are all located optimally for a Qwerty layout....
- By
July 07, 2016 11:50 AM
Why we use the Linux kernel's TCP stack
A recent blog post posed the question Why do we use the Linux kernel's TCP stack?. It triggered a very interesting discussion on Hacker News....
- By
April 05, 2016 12:05 PM
The revenge of the listening sockets
Back in November we wrote a blog post about one latency spike. Today I'd like to share a continuation of that story. As it turns out, the misconfigured rmem setting wasn't the only source of added latency. It looked like Mr Wolf hadn't finished his job....
- By
December 17, 2015 2:15 PM
Partial kernel bypass merged into netmap main
In a previous post we described our work on a new netmap mode called single-rx-queue. After submitting the pull request, the netmap maintainers told us that the patch was interesting, but they would prefer something more configurable instead of a tailored custom mode....
- By