Hi everyone, I am using inet_set_socket_state trace point to get current establish connection count Here, incrementing counter value in BPF map when new state is TCP_ESTABLISHED and decrementing when

I have to create a test-environment (based on vagrant) the last couple of days and i've done this with ubuntu 20.04 as base image. Is the repository https://github.com/iovisor/vagrant still active? If

Hi, Is it possible to load a BPF program at boot time? What I'm trying to achieve is to trace every single call to a certain function since the kernel starts, without missing anything. More specifical

Hello BPF Community! Hope you are all doing well. I am trying to have a user space program create a BPF Hash map with a single element containing its PID. This map could then be read by all the BPF pr

The project I am working on generically loads BPF object files, pins their respective maps, and then proceeds to use perf_buffer__poll from libbpf to poll the maps. I currently am polling the multiple

When using kprobe in bcc, I can get param directly like `int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)` But it seems not to work in kretprobe, I've found that I can get fi

The BPF UAPI header file <linux/bpf.h> includes <linux/types.h>, which gives BPF-programs access to types e.g. __u32, __u64, __u8, etc. On Ubuntu/Debian when compiling with clang option[1] "-target bp

Hi, I am trying to attach the same TC eBPF program instance to both host and container interfaces. So some of the maps need to be qualified with the netns id. I was wondering if there is a way to acce

Hello everyone, I'll start with some backstory first: I wrote my own BPF library to trace functions/syscalls and yesterday I noticed that I am sometimes receiving broken openat() tracepoint data. This

Hello, I am trying a port mirroring use case that basically mirrors traffic from host1 to host2. On host 1 I have two interfaces eth0 and eth1 and have configured vxlan interface on eth1. I have used

Hi, Lately, I've been working on in-kernel traffic analysis with eBPF and the newest features released in the latest kernel versions (queue/stack, batch operations,...). For some reason, I couldn't he

Hi, I’ve been reading that hash map’s update element is atomic and also that we can use BPF_XADD to make the entire map update atomically. But I think that doesn’t guarantee that these updates are thr

Replying here again for the record since you posted the same question on the k8s slack. Kubectl trace replaces $container_pid so you can access the pid folder in the host proc. it’s not specific only

(Cross-posting to iovisor-dev) Seeking input from BPF-llvm developers. How come Clang/LLVM 10+ is generating incompatible BTF-info in ELF file, and downgrading to LLVM-9 fixes the issue ? -- Best rega

Hello all, I am trying to retrieve the keys of an LPM Trie in my user space program (similar to https://github.com/iovisor/bcc/blob/master/examples/networking/xdp/xdp_macswap_count.py) however, I am a

Hello, I am trying to introduce USDT probe to an application and my bcc script is failing with following error: <snip> Traceback (most recent call last): File "test.py", line 40, in <module> b = BPF(t

Hi all, hope everyone is staying healthy out there. I've been working on building BPF programs, and have run into a few issues that I think might be clang (vs gcc) based. It seems that either clang is

Hi everybody, I am writing this email to ask for an opinion about how to address the following problem. Lately, I have been trying to develop an eBPF program that extracts some per-flow values and sto

Hello - I am looking to trace ip_forward_finish. The intent is to trace latency of all TCP connections going through a linux based gateway router. Hence thought of tracing ip_forward_finish kernel fun

Hi Potential PhD student, Reminder: Application deadline 15.May 2020 is really soon for our PhD position located in Sweden, at Karlstads University. See: "PhD position in Computer Science, programmabl