fentry

Overview ¶

This program demonstrates attaching a fentry eBPF program to tcp_connect. It prints the command/IPs/ports information once the host sent a TCP SYN packet to a destination. It supports IPv4 at this example.

Sample output:

examples# go run -exec sudo ./fentry 2021/11/06 17:51:15 Comm Src addr Port -> Dest addr Port 2021/11/06 17:51:25 wget 10.0.2.15 49850 -> 142.250.72.228 443 2021/11/06 17:51:46 ssh 10.0.2.15 58854 -> 10.0.2.1 22 2021/11/06 18:13:15 curl 10.0.2.15 54268 -> 104.21.1.217 80