gc
github.com/yuuki/gobpf-conntracer
go get github.com/yuuki/gobpf-conntracer
gc

github.com/yuuki/gobpf-conntracer

Go library using eBPF to trace network flow events

by Yuuki Tsubouchi

v0.1.0 (see all)License:Apache-2.0
go get github.com/yuuki/gobpf-conntracer
Readme

go-conntracer-bpf

Go Reference

go-conntracer-bpf is a library for Go for tracing network connection (TCP/UDP) events (connect, accept, sendto, recvfrom) on BPF kprobe inspired by weaveworks/tcptracer-bpf. go-conntracer-bpf is implemented on top of libbpf, which is a representative C library for BPF included Linux kernel.

Features

  • Low-overhead tracing by aggregating connection events in kernel.
  • BPF CO-RE (Compile Once – Run Everywhere)-enabled

Flow events aggregation in kernel

Prerequisites

Compilation phase

  • libbpf source code
  • Clang/LLVM >= 9

Runtime phase

Common to both phase

  • libelf and zlib libraries

Features of Linux kernel included in go-conntracer-bpf

go-conntracer-bpf makes use of some latest features of Linux kernel.

  • BPF Type Format (BTF) in kernel version 4.18.
  • Batch API to BPF map (BPF_MAP_UPDATE_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH) in kernel version 5.6.
  • Ring Buffer in kernel version 5.8 (only a flavor of no-aggregation in kernel).

Usage

conntop

conntop is a CLI tool to show connection events.

Build conntop

$ make DOCKER=1

Projects using go-conntracer-bpf

GitHub Stars

11

LAST COMMIT

1yr ago

MAINTAINERS

0

CONTRIBUTORS

1

OPEN ISSUES

0

OPEN PRs

0
VersionTagPublished
v0.1.1-0.20210419071833-e36514323db7
1yr ago
v0.1.0
1yr ago
v0.0.0-20210109141114-99fb7bce36d3
1yr ago
v0.0.0-20210109134217-fe5ce79d4fff
1yr ago
No alternatives found
No tutorials found
Add a tutorial