G'Day all, I have colleagues working on BCC Python tools (e.g., the recent enhancement of tcpconnect.py) and I'm wondering, given libbpf tools, what our advice should be. - Should we keep both Python

Hello everyone! I am experiencing some issues with the execveat tracepoints, and was wondering if others could reproduce it or help me understand what I am doing wrong. On Arch Linux (kernel 5.9.1, pe

Does the LLVM version used by bcc matter, for packaging purposes? I assume bcc includes some static libraries from LLVM, so I'm curious if the older versions are acceptable. For instance, on ubuntu 16

Thanks a lot, Yonghong. From your response: 1. How can I make a kernel function use the return value of a eBPF program/function? 2. An KProbes related question: from an old article https://lwn.net/Art

Hello BPF community, I am looking for a way to move a user space program's disk I/O scheduling related logic down to kernel space, and then have the new kernel logic communicate with the user space pr

Hi, I am looking for tracking inbound connections on a system using tracepoints/kprobes. I was checking "trace_inet_sock_set_state", with which we can track the state changes during connection establi

Hi everyone, I am using inet_set_socket_state trace point to get current establish connection count Here, incrementing counter value in BPF map when new state is TCP_ESTABLISHED and decrementing when

I have to create a test-environment (based on vagrant) the last couple of days and i've done this with ubuntu 20.04 as base image. Is the repository https://github.com/iovisor/vagrant still active? If

Hi, Is it possible to load a BPF program at boot time? What I'm trying to achieve is to trace every single call to a certain function since the kernel starts, without missing anything. More specifical

Hello BPF Community! Hope you are all doing well. I am trying to have a user space program create a BPF Hash map with a single element containing its PID. This map could then be read by all the BPF pr

The project I am working on generically loads BPF object files, pins their respective maps, and then proceeds to use perf_buffer__poll from libbpf to poll the maps. I currently am polling the multiple

When using kprobe in bcc, I can get param directly like `int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)` But it seems not to work in kretprobe, I've found that I can get fi

The BPF UAPI header file <linux/bpf.h> includes <linux/types.h>, which gives BPF-programs access to types e.g. __u32, __u64, __u8, etc. On Ubuntu/Debian when compiling with clang option[1] "-target bp

Hi, I am trying to attach the same TC eBPF program instance to both host and container interfaces. So some of the maps need to be qualified with the netns id. I was wondering if there is a way to acce

Hello everyone, I'll start with some backstory first: I wrote my own BPF library to trace functions/syscalls and yesterday I noticed that I am sometimes receiving broken openat() tracepoint data. This

Hello, I am trying a port mirroring use case that basically mirrors traffic from host1 to host2. On host 1 I have two interfaces eth0 and eth1 and have configured vxlan interface on eth1. I have used

Hi, Lately, I've been working on in-kernel traffic analysis with eBPF and the newest features released in the latest kernel versions (queue/stack, batch operations,...). For some reason, I couldn't he

Hi, I’ve been reading that hash map’s update element is atomic and also that we can use BPF_XADD to make the entire map update atomically. But I think that doesn’t guarantee that these updates are thr

Replying here again for the record since you posted the same question on the k8s slack. Kubectl trace replaces $container_pid so you can access the pid folder in the host proc. it’s not specific only

(Cross-posting to iovisor-dev) Seeking input from BPF-llvm developers. How come Clang/LLVM 10+ is generating incompatible BTF-info in ELF file, and downgrading to LLVM-9 fixes the issue ? -- Best rega