Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF7linux6observability4yeet3HTTP2kubernetes2networking2tcpdump2802.111AI agents1ai-sre1Cilium1integration-testing1rf1root-cause-analysis1security1uprobes1websocket1wifi1wireless1wss1

How to Capture 802.11 Frames on a Connected Interface on Linux: Your Radio Already Hears Them

Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.

wifi802.11wirelessrfeBPFlinuxobservabilityyeet
Read more →