HOW NETFLIX ACCURATELY ATTRIBUTES EBPF FLOW LOGS

Summary from the TLDR Web Dev newsletter

eBPF (Extended Berkeley Packet Filter) is a Linux kernel technology that allows users to run sandboxed programs within the kernel space. Netflix uses eBPF to capture TCP flow logs at scale but had challenges attributing IP addresses to the correct workload identities due to IP address reassignment in the cloud. It developed a new attribution method that first accurately attributes local IP addresses by using workload identity certificates and IP address assignment services. Then, its FlowCollector attributes remote IP addresses by tracking IP ownership time ranges learned from flows, which results in accurate, fleet-wide network insights.