Show HN: eBPF-powered L4 package dropper

Show HN: eBPF-powered L4 package dropper(github.com)

11 points by boratanrikulu 3 years ago | 4 comments

muxamilian 3 years ago |

With L4 you mean the transport layer? I’m a bit confused because in your examples you show layer 3 (IP).

This eBPF-based package dropper using machine learning (decision tree) might be of interest to you: https://github.com/CN-TU/machine-learning-in-ebpf

boratanrikulu 3 years ago | |

I meant Transport Layer packages.

> https://github.com/CN-TU/machine-learning-in-ebpf

Thank you! I'll take a look.

artemish 3 years ago |

Neat! So this is a tool you can use to implement firewall-ish rules and drop packets from certain IP addresses. It looks like the actual XDP code is written in C, and somehow makes its way into the Go program, is this the way EBPF tools are usually implemented in Go?

boratanrikulu 3 years ago | |

Thank you! Yes, AFAIK There's no way to code the eBPF part in Go, so I used C without loops. Go part handles loading the eBPF and utilizing the maps. Btw, Rust hcan be used as eBPF code language since It was added to the Kernel.