Monitoring Queue Disciplines with BPF

In this lesson, you will learn how to gain granular visibility into Linux traffic shaping decisions by attaching eBPF programs to Queue Discipline (qdisc) hooks.

Why Monitor Queue Disciplines?

When you configure traffic shaping—such as HTB (Hierarchical Token Bucket) or FQ_CODEL (Fair Queuing Controlled Delay)—the kernel makes complex decisions about which packets to prioritize, delay, or drop. While traditional tools like tc -s qdisc show provide aggregate statistics, they are "black boxes" that don't tell you why a specific packet was shaped a certain way. By using eBPF, we can observe the internal logic of these disciplines in real-time.

Tapping into the Qdisc Path

The Traffic Control (TC) subsystem hooks into the kernel's transmit path. When a packet passes through a qdisc, it triggers internal kernel functions like enqueue or dequeue. By attaching an eBPF program to these tracepoints, we can inspect packet metadata (like VLAN tags, DSCP markings, or queue occupancy) just as the kernel decides to throttle or schedule them.

Consider a scenario where you want to identify which specific TCP flows are causing "bufferbloat" in your fq_codel queue. Instead of guessing, you can write a small BPF observer:

SEC("tracepoint/qdisc/qdisc_dequeue")
int trace_dequeue(struct trace_event_raw_qdisc_dequeue *ctx) {
    // Access the qdisc handle and the packet length
    u32 qdisc_handle = ctx->handle;
    u32 len = ctx->pkt_len;

    // Use a BPF map to record latency or drop stats per-flow
    bpf_map_update_elem(&stats_map, &qdisc_handle, &len, BPF_ANY);
    return 0;
}

By tracing these hooks, you move from "guessing" the impact of your traffic shaping rules to "observing" the exact behavior of the queue. You can correlate packet drops with specific qdisc states, allowing you to fine-tune your parameters—like limit or target—based on empirical data rather than trial and error. This visibility is essential for maintaining predictable latency in high-throughput network environments.

Key Takeaway: Attaching eBPF programs to qdisc tracepoints allows you to transform opaque Traffic Control statistics into per-packet observability, enabling precise tuning of shaping policies.