Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Test and Debug WebSocket Traffic on Linux in 2026: Your Integration Test Asserts on the Client, Not the Wire
A WebSocket integration test asserts on what your client library returned, which is not what crossed the connection. How to see the real frames inside wss:// on Linux with wssnoop, Wireshark and a TLS keylog, mitmproxy and Chrome DevTools, and how to turn a captured session into a fixture your test suite can replay.
Traversal vs yeet: An AI SRE Reasons Over Your Telemetry, It Doesn't Collect It
Traversal's AI SRE runs causal search over the observability stack you already have, so its ceiling is what your instrumentation recorded; yeet is a JavaScript runtime for Linux ops that loads an eBPF probe for one missing fact while the incident is open. Which order to use them in, and how to test it against your own postmortems.
How to Capture 802.11 Frames on a Connected Interface on Linux: Your Radio Already Hears Them
Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.