PDP-02 · Programmable Data Planes
Program the kernel without rebooting it.
Write small programs that the kernel checks before it runs, load them into the packet path, and watch them drop, redirect and count traffic at line rate.
You build: an XDP data plane with live counters that a user-space tool reads.
Prefer to be taught it live? XDP & eBPF Programmable Networking (NET-201, 4 days) is the same material delivered in a scheduled cohort by an instructor, in person or online. See the live course · Live dates
Promise
Write, verify, load, and debug eBPF programs, and build an XDP data plane that drops, redirects, and measures traffic.
Prerequisites
PDP-01 recommended.
Units
1. Foundations ch 01–04
why programmable kernels, the environment, the first program.
2. The eBPF model ch 05–09
program types, the verifier, maps, helper functions.
3. XDP ch 10–15
the earliest hook, processing, actions, maps together, performance.
4. XDP applications ch 16–18
an L4 load balancer, DDoS mitigation, traffic monitoring.
5. Advanced structure ch 19–22
tail calls, BPF-to-BPF calls, CO-RE, libbpf.
6. Operations ch 23–30
user-space control, namespaces, Kubernetes, hardware offload, security, debugging, production.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| PDP-02ach 05 | Load a "hello" eBPF program and read its trace outputPass check: Output shows your message | vm45 min |
| PDP-02bch 11 | XDP program that drops ICMPPass check: Ping fails, TCP still works | vm60 min |
| PDP-02cch 16 | L4 load balancer with a backend mapPass check: Requests split across backends | sim90 min |
| PDP-02dch 22 | libbpf user-space loader for lab 02b with a stats printPass check: Stats match tcpdump counts | vm60 min |
Capstone project · CAP-13
DDoS Scrubber with Metrics · 3 weeks
An edge service needs volumetric attack filtering with visibility.
Build an XDP scrubber with rate limits, counters exported to user space, and a dashboard.
Deliverables: Source, attack simulation, dashboard.
Outcomes
- I can explain why the verifier rejects a program and how to fix it.
- I can build an XDP program that drops traffic by rule and counts it in a map.
- I can write a libbpf control program in user space.
- I can debug a program that loads but misbehaves.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 30 h of study including the labs. Most engineers take it part-time over a few weeks.