Sub-Millisecond Transit Latency Profiling via eBPF TC Filters

Traditional user-space ICMP or UDP ping tools suffer from kernel-to-user context switch latency and scheduling jitter, making sub-millisecond precision impossible under load. By attaching an eBPF program directly to the clsact TC ingress hook, we capture hardware timestamps at the lowest possible layer before socket queues.

SEC("tc")
int tc_ingress_probe(struct __sk_buff *skb) {
    void *data = (void *)(long)skb->data;
    void *data_end = (void *)(long)skb->data_end;
    __u64 ts = bpf_ktime_get_ns();
    // Parse IPv4 + TCP options for timestamp reflection
    return TC_ACT_OK;
}

The collected ring buffer events are mapped directly into user-space shared memory without per-packet syscalls. Across three months of logging, this pipeline tracked micro-flapping along transit providers that standard SNMP polling intervals completely missed.