eCHO news is your bi-weekly wrap up of all things eBPF and Cilium. If you want to keep up on the latest in cloud native networking, observability, and security this is your quelle

20th October 2026

Linux Plumbers Conference wrapped up in Prague earlier this month, and the eBPF track page now has the slides and recordings. Talks covered the verifier, including proof-carrying verification, and faster responses to kernel vulnerabilities, such as the live mitigations in shirudo. PlayStation and Meta also described how they run eBPF in production, for DDoS defense and for hardening confidential VMs.

This edition also covers the fourth installment of Cloudflare’s series on running its network on eBPF, which shows how it finds problems and stops attacks. Hudson River Trading explains how it tracked down what was saturating a long-distance network link, and Epic describes a Linux anti-cheat that uses eBPF without a kernel driver.

CiliumCon is less than 3 weeks away, and the agenda includes ESnet on IPv6-only ClusterMesh, OpenAI on debugging inference workloads with eBPF, and Datadog on a fleet-wide netkit migration. I need to start my KubeCon talk, so let's 🐝-gin.

The Technical

Cloudflare’s eBPF Replatforming Part 4: Observability, Operations, and Reliability Improvements from eBPF

An edge-local eBPF pipeline dropped 8m pps with only a 10% CPU rise

Adding inlined functions to the BPF Type Format

New BTF kinds will record inline sites so they can be traced

Is XDP more performant than TC?

XDP cut cycles per packet by 28% on virtio-net but was 1.7% slower on veth

Tracing a network mystery across HRT’s global compute cluster

Hudson River Trading attributes WAN traffic to users and workflows with eBPF hooks on TCP and NFS

Does moving a GPU server's request loop into the kernel save CPU?

An eBPF-based GPU server performed about the same as a conventional one

Testing eBPF code: automatic tail call resolution

Tail calls were the one place the framework still depended on bookkeeping by hand

Cilium IPAM: Pod CIDR Modes, LB-IPAM and L2 Announcements for a Bare-Metal LoadBalancer

How a Cilium LoadBalancer IP behaves when the node announcing it dies

puranjaymohan/blitmus

Run litmus tests as BPF programs to check the eBPF memory model on hardware

himadrics/phantom-tracker

Feed host scheduler data from eBPF to guest VMs through shared memory

🐝

The Ecosystem

eBPF Foundation Announces 2026 Community & Advocacy Fellowship Recipients

Dr. Constanze Roedig (SBoB runtime baselines for CNCF projects) & Rishi Mondal (eBPF production operations and Cilium debugging content)

CiliumCon is back at KubeCon + CloudNativeCon North America 2026

Featuring talks on AI networking and sidecarless mTLS

Awesome Gaming on Linux Without Cheating

Epic’s Linux anti-cheat uses BPF LSM instead of a kernel module

🐝

The How To

Cilium's Gateway Api

Migrating from Ingress NGINX to Cilium’s Gateway API on a home cluster
🐝

The Video

Recordings and slides for the eBPF track at LPC are now available

Talks cover verifier work, Rust support and security mitigations

🐝

The Events

CiliumCon

November 9 in Salt Lake City, schedule now live 

Security Native Europe

November 26 in Zurich, headlined by Daniel Borkmann on eBPF's role in live system hardening

CiliumCon Europe

March 15, 2027 in Barcelona

🐝 

The Livestreams

eCHO Episode 216: eBPF Labs Sneak Peek

eCHO Episode 217: Kubernetes on Oxide Computer

The Post of the Week

As always, if you’ve seen a blog post, a tool, or anything else eBPF or Cilium related that you think the rest of the community should hear about, send them my way. You can either hit reply or join the #echo-news channel on Cilium Slack. You can also find all of the past episodes on the website.

🐝

To make sure you keep getting these emails, please add kaoconno@cisco.com to your address book or otherwise mark me as a permitted sender.

Know a friend that needs to be in the know? Forward this to them

Was this forwarded to you? Sign up today!

Written and sent by Katie Meinders. Any feedback is welcome!