Jacob Pradels
Founding Engineer
Founding engineer at yeet, working on kernel-side observability and the tooling around it. I write about eBPF, Linux internals, and why your telemetry bill looks the way it does.
Blog
View all →Topical Takes
View all →How to Capture Packets on wg0 and Other Tunnel Interfaces on Linux: The Ethernet Header Is Not Missing, It Was Never There
Capturing on wg0, gre1 or tun0 hands you a bare IP packet, because a raw-IP tunnel device has no MAC header to give you; pktscope is a terminal packet analyzer whose TCX eBPF tap starts the snap at the MAC header on Ethernet-framed devices and at the network header on tunnels, so the decode and the hex offsets match the device you picked.
Traversal vs yeet: An AI SRE Reasons Over Your Telemetry, It Doesn't Collect It
Traversal's AI SRE runs causal search over the observability stack you already have, so its ceiling is what your instrumentation recorded; yeet is a JavaScript runtime for Linux ops that loads an eBPF probe for one missing fact while the incident is open. Which order to use them in, and how to test it against your own postmortems.
How to Capture 802.11 Frames on a Connected Interface on Linux: Your Radio Already Hears Them
Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.
eBPF-Speed L7 Enforcement Without a CNI Migration
Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.