Live data from Hacker News

How Netflix Accurately Attributes eBPF Flow Logs

netflixtechblog.com

51–60 of 61 posts

Re: How Netflix Accurately Attributes eBPF Flow Logs

#51

If you are interested in network monitoring in Kubernetes, it's worth looking at Kubenetmon: https://github.com/ClickHouse/kubenetmon - an open-source eBPF-based implementation from ClickHouse.

i mean.. from your blog post linked in the repo; this isn't eBPF based?

https://clickhouse.com/blog/kubenetmon-open-sourced

the data collection method says: "conntrack with nf_conntrack_acct"

Re: How Netflix Accurately Attributes eBPF Flow Logs

#52
Is it necessary to rely on ip address attribution? If FlowExporter uses ebpf and tcp tracepoints, could each workloads be placed in its own cgroup and could FlowExporter directly introspect which cgroup (and thus, workload) a given tcp socket event should be attributed to?

Re: How Netflix Accurately Attributes eBPF Flow Logs

#53
post #49

Earlier quoted context omitted.

And more importantly none of this is required. Pornhub pushes more video data on far more unreliable connections without any of this madness. This is purely a play to get the tech company multiple. Nothing else. This is Wework style coverup.

People might be more tolerant to quality issues for pornhub‘s content than Netflix‘s.

Why might that be?

Re: How Netflix Accurately Attributes eBPF Flow Logs

#55
post #50
post #23

Question to the Netflix folks: I saw a lot of in-house developed tools being quoted, do you guys have service mesh like linkerd ? Have you guys evaluated vendors like Kentik? I would love to get more insight into what do you guys actually do with flow logs? for example if I store 1 TB of flow logs, what value can I actually derive from them that justify the cost of collection, processing, and storage.

Exactly my thought. Maybe it's the "not invented here" syndrome? We use Istio as Service Mesh and get the same result, using the same architecture as shown in the blog post (especially the part where each workload has a sidecar container running Flow).

From my experience in big tech, another reason is that OPS guys just cant resist the concept of eBPF, go all the way done trying to figure out what this beautiful technology can do and forgot what thery really wanted at the begining.

Re: How Netflix Accurately Attributes eBPF Flow Logs

#56

I wonder how much of Netflix infra is on AWS. Feels like building a castle on someone else's kingdom at that scale; in light of the Prime Video investment, and I guess twitch too.

Netflix serves nearly all of its video from a server down the street from you via its OpenConnect infrastructure. AWS only hosts its microservice graph that does stuff like determining which videos and qualities you should be offered. That being said, its core product has been nearly comoditized. When Netflix entered the market, delivering long form high quality video over the public internet was nascent. Now everyon…

Any chance you would be able to point me to a good source or article describing/explaining the first half of your comment? I.e. someone getting into the nuts and bolts?

Netflix is a platform - their strategic advantage is in their content sourcing and development pipeline which is fed the unique insights on audience preferences. This is distributed with recommendation algorithms and UX. It could be argued, like someone also already pointed out, that this infra aspect is a commodity at this point.

Re: How Netflix Accurately Attributes eBPF Flow Logs

#57

Earlier quoted context omitted.

Netflix serves nearly all of its video from a server down the street from you via its OpenConnect infrastructure. AWS only hosts its microservice graph that does stuff like determining which videos and qualities you should be offered. That being said, its core product has been nearly comoditized. When Netflix entered the market, delivering long form high quality video over the public internet was nascent. Now everyon…

Any chance you would be able to point me to a good source or article describing/explaining the first half of your comment? I.e. someone getting into the nuts and bolts? Netflix is a platform - their strategic advantage is in their content sourcing and development pipeline which is fed the unique insights on audience preferences. This is distributed with recommendation algorithms and UX. It could be argued, like someo…

https://openconnect.netflix.com/en/

there are attempts to serve high bandwidth throughput, I think the last update was below.

https://news.ycombinator.com/item?id=40329303

Re: How Netflix Accurately Attributes eBPF Flow Logs

#58

I wonder how much of Netflix infra is on AWS. Feels like building a castle on someone else's kingdom at that scale; in light of the Prime Video investment, and I guess twitch too.

Netflix serves nearly all of its video from a server down the street from you via its OpenConnect infrastructure. AWS only hosts its microservice graph that does stuff like determining which videos and qualities you should be offered. That being said, its core product has been nearly comoditized. When Netflix entered the market, delivering long form high quality video over the public internet was nascent. Now everyon…

AWS also hosts all of Netflix’ internal apps (which probably dwarfs the amount of actual public facing stuff)

Re: How Netflix Accurately Attributes eBPF Flow Logs

#59

Is it necessary to rely on ip address attribution? If FlowExporter uses ebpf and tcp tracepoints, could each workloads be placed in its own cgroup and could FlowExporter directly introspect which cgroup (and thus, workload) a given tcp socket event should be attributed to?

That may help identify the local IPs but not the remote IPs.

Re: How Netflix Accurately Attributes eBPF Flow Logs

#60

Earlier quoted context omitted.

Despite their awful UX, I'm always impressed with how reliable their service is, technically speaking. Video is always good and responsive even on less-than-stellar connections, you can leave a show paused for hours, and resume it almost instantly. Their fast.com speed test is always much faster than your regular internet access, I guess thanks to their Open Connect Appliances. It must be great to work for them in in…

Not that this detracts from the wider point, but I'd expect unpause to just work unless you go out of your way to make it not work. Even if you drop the connection at some point, afaik they use ~15 Mb/s as their "premium" bitrate, so e.g. a 30 s buffer takes less than 64 MB. That gives plenty of time to re-establish streaming after an unpause. It's not like the computer forgets what it was doing if you leave it alone…

Counterpoint: Plex and Jellyfin free resources if you leave your video paused too long, and it will take a noticeably amount of time to resume streaming, much more if it needs transcoding.

They're not going out of their way to annoy us, they try to be efficient with the finite resources a home server has. Netflix is going out of their way to make it smooth no matter what you do, even if they have to pool a bit of their own resources for it.

Post reply on HN