bpf

type BPFCollector ¶

type BPFCollector struct {
	// contains filtered or unexported fields
}

BPFCollector manages the eBPF programs, maps, and links

func NewBPFCollector(cgroupPath string) (*BPFCollector, error)

func (c *BPFCollector) Close() error

func (c *BPFCollector) DrainDeltas() ([]FlowDelta, error)

func (c *BPFCollector) LookupPIDMetadata(pid uint32) (*MonitoProcInfo, bool)

func (c *BPFCollector) ReadCounters() DiagnosticCounters

func (c *BPFCollector) StopAccounting() error

type DiagnosticCounters ¶

type DiagnosticCounters struct {
	TotalIngressPackets uint64
	TotalEgressPackets  uint64
	SocketsRegistered   uint64
	UnattributedIngress uint64
	UnattributedEgress  uint64
	MapErrors           uint64
	RecoveredSockets    uint64
	RecoveryErrors      uint64
}

DiagnosticCounters represents kernel BPF health and capacity metrics

type FlowDelta ¶

type FlowDelta struct {
	PID       uint32
	Category  TrafficCategory
	RxBytes   uint64
	TxBytes   uint64
	RxPackets uint64
	TxPackets uint64
}

FlowDelta represents accumulated network delta for a PID and category

type MonitoFlowKey ¶

type MonitoFlowKey struct {
	Pid      uint32
	Category uint8
	Pad      [3]uint8
}

type MonitoFlowMetrics ¶

type MonitoFlowMetrics struct {
	Generation uint64
	RxBytes    uint64
	TxBytes    uint64
	RxPackets  uint64
	TxPackets  uint64
}

type MonitoMapSpecs ¶

type MonitoMapSpecs struct {
	Counters    *ebpf.MapSpec `ebpf:"counters"`
	FlowStats   *ebpf.MapSpec `ebpf:"flow_stats"`
	PidMetadata *ebpf.MapSpec `ebpf:"pid_metadata"`
	SockOwners  *ebpf.MapSpec `ebpf:"sock_owners"`
}

MonitoMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoMaps ¶

type MonitoMaps struct {
	Counters    *ebpf.Map `ebpf:"counters"`
	FlowStats   *ebpf.Map `ebpf:"flow_stats"`
	PidMetadata *ebpf.Map `ebpf:"pid_metadata"`
	SockOwners  *ebpf.Map `ebpf:"sock_owners"`
}

MonitoMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

func (m *MonitoMaps) Close() error

type MonitoObjects ¶

type MonitoObjects struct {
	MonitoPrograms
	MonitoMaps
	MonitoVariables
}

MonitoObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

func (o *MonitoObjects) Close() error

type MonitoProcInfo ¶

type MonitoProcInfo struct {
	Pid      uint32
	Tgid     uint32
	CgroupId uint64
	Comm     [16]int8
}

type MonitoProgramSpecs ¶

type MonitoProgramSpecs struct {
	OnEgress     *ebpf.ProgramSpec `ebpf:"on_egress"`
	OnIngress    *ebpf.ProgramSpec `ebpf:"on_ingress"`
	OnSockCreate *ebpf.ProgramSpec `ebpf:"on_sock_create"`
	OnSocketIo   *ebpf.ProgramSpec `ebpf:"on_socket_io"`
	OnSockops    *ebpf.ProgramSpec `ebpf:"on_sockops"`
}

MonitoProgramSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoPrograms ¶

type MonitoPrograms struct {
	OnEgress     *ebpf.Program `ebpf:"on_egress"`
	OnIngress    *ebpf.Program `ebpf:"on_ingress"`
	OnSockCreate *ebpf.Program `ebpf:"on_sock_create"`
	OnSocketIo   *ebpf.Program `ebpf:"on_socket_io"`
	OnSockops    *ebpf.Program `ebpf:"on_sockops"`
}

MonitoPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

func (p *MonitoPrograms) Close() error

type MonitoSpecs ¶

type MonitoSpecs struct {
	MonitoProgramSpecs
	MonitoMapSpecs
	MonitoVariableSpecs
}

MonitoSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoVariableSpecs ¶

type MonitoVariableSpecs struct {
}

MonitoVariableSpecs contains global variables before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoVariables ¶

type MonitoVariables struct {
}

MonitoVariables contains all global variables after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

type TrafficCategory ¶

type TrafficCategory uint8

TrafficCategory represents the traffic destination / type

const (
	CategoryLoopback TrafficCategory = 0
	CategoryPrivate  TrafficCategory = 1
	CategoryExternal TrafficCategory = 2
	CategoryUnknown  TrafficCategory = 3
)

func (c TrafficCategory) String() string