Skip to content

Commit

Permalink
Documentation update and new logo
Browse files Browse the repository at this point in the history
  • Loading branch information
dkorunic committed Apr 3, 2024
1 parent 94ff084 commit 508469d
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 12 deletions.
24 changes: 12 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
[![GitHub license](https://img.shields.io/github/license/dkorunic/pktstat-bpf)](https://github.com/dkorunic/pktstat-bpf/blob/master/LICENSE)
[![GitHub release](https://img.shields.io/github/release/dkorunic/pktstat-bpf)](https://github.com/dkorunic/pktstat-bpf/releases/latest)

![](gopher.png)
![](gopher.jpg)

## About

pktstat-bpf is a simple replacement for ncurses-based [pktstat](https://github.com/dleonard0/pktstat), using Linux eBPF ([extended Berkeley Packet Filter](https://prototype-kernel.readthedocs.io/en/latest/bpf/)) program, allowing packet statistics gathering even under **very high traffic volume** conditions, typically several million packets per second even on an average server. In this scenario (high volume, DoS attacks etc.) typically both regular PCAP or AF_PACKET solutions start being unreliable due to increasing packet loss.
pktstat-bpf is a simple replacement for ncurses/libpcap-based [pktstat](https://github.com/dleonard0/pktstat), using Linux eBPF ([extended Berkeley Packet Filter](https://prototype-kernel.readthedocs.io/en/latest/bpf/)) program, allowing packet statistics gathering even under **very high traffic volume** conditions, typically several million packets per second even on an average server. In this scenario (high volume, DoS attacks etc.) typically regular packet capture solutions start being unreliable due to increasing packet loss.

By default it uses **TC** (Traffic Control) eBPF hooks with TCX attaching and that requires at minimum Linux kernel **v6.6** for both ingress and egress traffic statistics. Alternatively it can switch to [XDP](https://github.com/xdp-project/xdp-tutorial) (eXpress Data Path) hook but with a consequence of **losing egress statistics** since **XDP** works only in ingress path. XDP mode supports older kernels, starting with Linux kernel v4.8, but XDP program to network interface attaching call requires Linux kernel **v5.9**. As always, some distributions might have backported patches (notable example is Red Hat Enterprise Linux kernel) and XDP/TC eBPF program might work on older kernels too.
By default it uses **TC** (Traffic Control) eBPF hooks with TCX attaching requiring at minimum Linux kernel **v6.6** for both ingress and egress traffic statistics. Alternatively it can switch to [XDP](https://github.com/xdp-project/xdp-tutorial) (eXpress Data Path) hook but with a consequence of **losing egress statistics** since **XDP** works only in ingress path. XDP mode due to XDP program to network interface attaching calls requires at minimum Linux kernel **v5.9**. Some distributions might have backported XDP/TC patches (notable example is Red Hat Enterprise Linux kernel) and eBPF program might work on older kernels too.

At the end of the execution program will display per-IP and per-protocol statistics sorted by per-connection bps, packets and (source-IP:port, destination-IP:port) tuples.

Expand All @@ -19,7 +19,7 @@ Program consists of the [eBPF code in C](counter.c) and the pure-Go userland Gol

## Requirements

Loading eBPF program typically requires root privileges, but it is also possible to run rootless and set specific CAP_BPF and CAP_NET_ADMIN [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html):
Loading eBPF program typically requires root privileges, but it is also possible to run rootless and set specific `CAP_BPF` and `CAP_NET_ADMIN` [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html):

```shell
$ setcap CAP_BPF,CAP_NET_ADMIN=eip pktstat-bpf
Expand All @@ -35,14 +35,14 @@ In case of XDP, not all NIC drivers support **Native XDP** (XDP program is loade

The following table maps features, requirements and expected performance for described modes:

| Capture type | Ingress | Egress | Performance | Kernel required | SmartNIC required |
| ------------------------------------------------ | ------- | ------ | -------------- | --------------- | ----------------- |
| [PCAP](https://github.com/dkorunic/pktstat) | Yes | Yes | Low | Any | No |
| [AF_PACKET](https://github.com/dkorunic/pktstat) | Yes | Yes | Medium | Any | No |
| TC | Yes | Yes | **High** | v6.6 | No |
| XDP Generic | Yes | **No** | **High** | v5.9 | No |
| XDP Native | Yes | **No** | **Very high** | v5.9 | No |
| XDP Offloaded | Yes | **No** | **Wire speed** | v5.9 | **Yes** |
| Capture type | Ingress | Egress | Performance | Kernel required | SmartNIC required |
| --------------------------------------------------- | ------- | ------ | -------------- | --------------- | ----------------- |
| Generic [PCAP](https://github.com/dkorunic/pktstat) | Yes | Yes | Low | Any | No |
| [AF_PACKET](https://github.com/dkorunic/pktstat) | Yes | Yes | Medium | Any | No |
| TC | Yes | Yes | **High** | v6.6 | No |
| XDP Generic | Yes | **No** | **High** | v5.9 | No |
| XDP Native | Yes | **No** | **Very high** | v5.9 | No |
| XDP Offloaded | Yes | **No** | **Wire speed** | v5.9 | **Yes** |

A list of XDP compatible drivers follows (and it is not necessarily up-to-date):

Expand Down
Binary file added gopher.jpg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed gopher.png
Binary file not shown.

0 comments on commit 508469d

Please sign in to comment.