In this talk, we are going to discuss how to go from zero to hero in understanding which of your workloads send how much data to each other. We'll talk about popular observability solutions, such as Cilium Hubble, Flow Logs, tools like Retina, and others, and where they fall short. We will then talk about how you can design and engineer a solution for network monitoring of your own: we'll learn about Linux's netfilter, conntrack, Kubernetes informers, and ClickHouse, and how these pieces can be fit together to help you track all connections in your cloud clusters.

I'm Ilya, and I have been working on low-level and large-scale networking problems at Cloudflare, and now at ClickHouse. At Cloudflare, I worked on distributed L3 DDoS protection, routing, and firewall systems, pushed the Linux kernel to its limit, as well as built high-performance API security products. At ClickHouse, this talk will cover what I have been working on for most of the last year.