Nicheloom visits: 58,684 all-time · 7,637 in the last 7 days

The opportunity tracker for new startups.

Today: 1,008 launches · Niche of the day: specialized calculation tools · See what launched today →

Spliff

Correlating XDP and TLS via eBPF (Building a Linux EDR)

Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.

Want to reach these readers? Sponsor an issue.

HN · launched Jan 17, 2026 · 5 upvotes (top 90%) · 0 views

Niche: incident response software · 72 launches, 2 in the last 7 days ▼ -71% · Explore this niche →

Category and tags
  • Security
  • Observability & eval
  • Developer
  • Not AI
  • Hobby / open-source project

Visit website ↗ Source listing ↗

More like this: all 72 launches in incident response software →

Could you build this?

No Correlating raw network packets at the XDP level with user-space TLS sessions via kernel eBPF probes requires elite Linux kernel internals, network stack, and security telemetry engineering expertise.

What it would actually take: The architecture requires an XDP driver-level eBPF program for high-speed packet ingestion, paired with kprobes/uprobes targeting OpenSSL/BoringSSL/kernel TLS socket structures to intercept plaintext data and socket file descriptors. The hard parts are tracking connection state across kernel boundaries without dropping packets, parsing complex memory offsets across varying Linux kernel/library versions (CO-RE/BTF), and correlating ephemeral cryptographic sessions with low-level sk_buff/xdp_buff representations. This demands deep expertise in Linux kernel networking, eBPF development, and low-level binary analysis.

Discussion

14 comments analyzed.

Competitors mentioned: Cilium - full CNI with XDP/Netkit for Kubernetes, Commercial EDRs - existing endpoint detection and response solutions

Concerns raised: SmartNIC hardware offload not currently usable - no CLI option, complex BPF maps not offload-compatible, Driver support varies - many NICs fall back to SKB mode instead of native XDP, Stateful flow tracking can't be fully offloaded to hardware, Requires kernel 5.x+ with BTF and XDP support

Feature requests: SmartNIC/hardware offload support with offload-compatible BPF programs, CLI option to enable XDP hardware offload mode, Process behavior tracking and anomaly detection, Event streaming integration (NATS/Kafka), Threat intelligence integration

Competitors

Other products that read as similar to this one : 3245 launches clear the similarity bar, closest 8 shown.

Attention rank: #2984 of 3246 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).

Launched 78 days after the earliest competitor.

Related data

The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.