August 2026
There's a daemon running on my dev box right now that is watching every TCP connection I make and quietly reconfiguring the kernel to make them faster. No restart. No manual tuning. No one asked it to.
That's bpftune — BPF-based auto-tuning of kernel parameters. It attaches to kernel events, samples what the traffic actually looks like, and adjusts sysctls while the system runs. I installed it as a systemd service a week ago. Here's what it's done since.
On its last full day of running, bpftune made 71,504 per-connection congestion-control decisions — and it did not default everything to one algorithm. The real split:
Check the live flows on any given boot and you can see why it's splitting the traffic. A ~4ms-round-trip path sits on BBR (pacing the delivery rate). Sub-millisecond LAN connections ride HTCP. A sub-ms local connection runs Cubic at 32 Gbps. bpftune matches the algorithm to the path instead of hoping one size fits all.
Eleven BPF programs hooked into the kernel: packet drops, receive-buffer samples, neighbor creation, route garbage collection, sysctl writes, a connection tuner, and more. To keep overhead sane, it throttles its own sampling — last boot it recorded 6.6 million network-completion events and 4.6 million receive-space samples, collecting roughly every 32nd and every 8th respectively.
Here's the honest catch: bpftune learns, and then forgets everything on reboot. The first time I ran it, it spent hours observing traffic, worked out that my TCP receive buffers wanted to grow to 160 MB, tuned upward — and then the next boot reset to the stock 32 MB default and started over from zero.
The fix was a one-file lesson: I snapshotted its converged floor into a sysctl drop-in. Now the box boots already knowing the ceiling, and within five seconds of the service starting this morning it had re-added HCTCP and DCTCP to the allowed congestion-control set. bpftune stays authoritative from that floor and keeps tuning upward.
0.1% of a core. 11.6 MB of RAM. Zero softnet drops, clean NICs, ECN enabled.
That's the entire bill for a box that continuously re-tunes itself — and the only real operational gotcha is the one that resets on reboot, which is exactly the kind of thing worth writing down.
Built on a home lab, powered by local models, and owned by Andrew Katana.