EBPF

OSI gives you 7 clean layers and tells you every packet goes through all of them in order. Modern networking disagrees. This post proposes a replacement model built around how systems actually behave: OS Kernel as its own layer, Proxy/Middleware as a first-class citizen, floating layers for protocols that shift placement based on deployment (TLS, eBPF, mTLS), and stack profiles for DPDK bypass, eBPF extension, and sidecar mesh. Positions taken on DoH, AF_XDP, io_uring, TOE offloads, and hardware crypto.

LockBit 5.0 Linux encrypts files with ChaCha20+Curve25519 with zero network activity — the public key is embedded at compile time. strace attachment triggers immediate termination. Free space is actively wiped post-encryption to prevent carving. Full analysis pipeline: eBPF syscall tracing, Ghidra static RE of crypto routines, pcap-confirmed network behavior, and extracted IOCs including file markers, dropped ransom note paths, and encryption extension patterns.

eBPF executes verified bytecode at kernel hook points — kprobes, tracepoints, XDP driver level — with JIT-compiled native performance and no module stability risk. XDP intercepts packets before the kernel networking stack for DDoS mitigation at millions of packets/second. Kprobes attach to any kernel function for real-time syscall argument tracing. Security application: behavioral detection that captures syscall sequences regardless of compiler artifacts or CFG obfuscation — the only reliable detection layer against pure assembly implants.