Jacob Pradels

A load balancer forgets an idle connection, a connection pool remembers it, and the first request after a quiet stretch gets a TCP reset the client logs as a 502 from a service that never saw it. AWS documents the behavior at 350 seconds, without a FIN. We reproduced it with nginx and one nftables rule, then wrote 110 lines of eBPF on yeet that name the sender, the owning process and the idle gap in one line.

Jellyfin's dashboard says Transcoding whether Quick Sync is doing the work or your CPU is. The kernel knows which: the ffmpeg it spawned either holds /dev/dri/renderD128 open or it doesn't. We wrote jellytop on yeet, a top for Jellyfin transcodes that reads the fd table, the argv and the CPU ticks of every encoder on the box, and ran it on an N100 with hardware acceleration on, off, and misconfigured.

An app fires StatsD datagrams at a port with no listener and Grafana shows the request rate anyway. We replaced prometheus/statsd_exporter with 165 lines of eBPF and a JavaScript decoder on yeet: the kernel reads the datagram, a sandbox with no sockets counts it, and Prometheus scrapes the result. First in a series on replacing every exporter with one binary.

Your SBOM describes a machine that does not exist. We built a runtime bill of materials on yeet that asks the kernel what is actually executing, which shared objects each process has mapped, and whether the function named in an open advisory is actually in memory, across a fleet, from a sandbox that can't leak.

Do you know what each action is doing on your system?

Omarchy shell plugins are QML by default, but the QML the shell loads can be a fixed client that mirrors a tree described elsewhere: yeetkit-omarchy runs a SolidJS page in a yeet isolate and patches it into the Quickshell bar item over the process's own pseudoterminal, with no port, no socket and no timer, which is how proctop draws live braille CPU and memory charts from kernel subscriptions.

Every exec a build starts is already visible to the kernel through the sched_process_exec tracepoint, so the hard part is volume and scope: execsnoop, strace -f, auditd, set -x and exectop compared on what each one can scope to one process tree and what each does with 7,745 lines of output.

Capturing on wg0, gre1 or tun0 hands you a bare IP packet, because a raw-IP tunnel device has no MAC header to give you; pktscope is a terminal packet analyzer whose TCX eBPF tap starts the snap at the MAC header on Ethernet-framed devices and at the network header on tunnels, so the decode and the hex offsets match the device you picked.

Traversal's AI SRE runs causal search over the observability stack you already have, so its ceiling is what your instrumentation recorded; yeet is a JavaScript runtime for Linux ops that loads an eBPF probe for one missing fact while the incident is open. Which order to use them in, and how to test it against your own postmortems.

Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.

Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.