Instrumenting BIND 9 on Linux with BCC/eBPF, 16 November 2021
eBPF, the “extended Berkeley Packet Filter,” is a powerful technology to instrument the Linux Kernel and applications. It will probably replace the traditional Linux Firewall (netfilter/iptables/nftables) in the coming years, so if you are not using it yet, you should learn now.
eBPF tools and scripts can be used to gain insight into a running processes, such as named. eBPF also provides valuable information for performance tuning on Linux. eBPF sees not only the network packets (like a traditional firewall), but also the syscalls and other kernel information. So it is possible to create richer firewall rules based on application data.
This webinar gives an introduction into the eBPF/BCC toolset and shows how to use the tools to inspect a running BIND 9 process. We walk through the process of creating an eBPF script that logs BIND 9 forwarding actions (something that BIND itself doesn't do).
At the end of this webinar there will be an optional Hands-On Session (instructions here: https://webinar.defaultroutes.de/webi.... For those of you watching the recording - sorry, this is why you have to come to the live webinar! (The slides are available at: https://www.isc.org/docs/2021webinar_...)
You are welcome to post your questions about BIND 9 DNS on our helpful community mailing list at https://lists.isc.org/mailman/listinf.... The BIND Administrative Reference Manual is online at https://bind9.readthedocs.io/en/stable/. We also maintain a knowledgebase of handy technical articles at https://kb.isc.org.
Internet Systems Consortium maintains and publishes the BIND 9 DNS software under the open source MPL 2.0 license. ISC is a non-profit, operating to help support the Internet infrastructure and facilitate independent connection to and participation in the Internet. We support this work by offering users professional technical support contracts, including advance notification of security vulnerabilities before public disclosure.
---
Learn more at https://www.isc.org