[mdaverde]

You can see the interpreter instructions through bpftool:

  bpftool prog dump xlated id 173

To see the JITed instructions:

  bpftool prog dump jited id 173

For the interpreted insns, you can also see the instructions in different forms, which is pretty neat. For example you can get a control flow graph in DOT format with `visual` specified at the end:

  bpftool prog dump xlated id 173 visual

I learned about these commands through this blog post: https://qmonnet.github.io/whirl-offload/2021/09/23/bpftool-f...

[sillystuff]

Thanks. Visibility seems to be pretty good. Something like AIDE/Tripwire for BPF might be the next step.

[nickstinemates]

This is effectively what Falco(https://falco.org/) is