{"id":20115503,"url":"https://github.com/asphaltt/skbtracer-iptables","last_synced_at":"2026-01-31T02:32:19.779Z","repository":{"id":138614670,"uuid":"607172036","full_name":"Asphaltt/skbtracer-iptables","owner":"Asphaltt","description":"skbtracer on iptables based on eBPF. Apache License 2.0","archived":false,"fork":false,"pushed_at":"2024-10-30T14:52:57.000Z","size":749,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-06T13:46:43.467Z","etag":null,"topics":["bpf","cilium-ebpf","ebpf","ebpf-co-re","golang","iptables","skbtracer","skbtracer-iptables"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Asphaltt.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-27T13:16:46.000Z","updated_at":"2024-10-30T14:55:55.000Z","dependencies_parsed_at":null,"dependency_job_id":"11ebead4-d52c-47c9-9488-72c48c747806","html_url":"https://github.com/Asphaltt/skbtracer-iptables","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Asphaltt/skbtracer-iptables","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Asphaltt%2Fskbtracer-iptables","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Asphaltt%2Fskbtracer-iptables/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Asphaltt%2Fskbtracer-iptables/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Asphaltt%2Fskbtracer-iptables/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Asphaltt","download_url":"https://codeload.github.com/Asphaltt/skbtracer-iptables/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Asphaltt%2Fskbtracer-iptables/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28927178,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-30T22:32:35.345Z","status":"online","status_checked_at":"2026-01-31T02:00:09.179Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bpf","cilium-ebpf","ebpf","ebpf-co-re","golang","iptables","skbtracer","skbtracer-iptables"],"created_at":"2024-11-13T18:35:29.599Z","updated_at":"2026-01-31T02:32:19.765Z","avatar_url":"https://github.com/Asphaltt.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# skbtracer-iptables\n\n`skbtracer-iptables` is an eBPF-based\n[skbtracer](https://github.com/Asphaltt/skbtracer) focused on iptables.\n\n## kernel\n\n`skbtracer-iptables` requires \u003e= 5.2 kernel with **CONFIG_DEBUG_INFO_BTF=y**.\n\n## kprobes\n\n- `ipt_do_tables`: attach eBPF program on kprobe and kretprobe of this function\n  for IPv4.\n- `ip6t_do_tables`: attach eBPF program on kprobe and kretprobe of this function\n  for IPv6.\n\nBut, at kernel 5.16, the declarations of `ipt_do_tables` and `ip6t_do_tables`\nchanged.\n\n```C\n// from\n\nextern unsigned int ipt_do_table(struct sk_buff *skb,\n         const struct nf_hook_state *state,\n         struct xt_table *table);\n\n// to\n\nextern unsigned int ipt_do_table(void *priv,\n         struct sk_buff *skb,\n         const struct nf_hook_state *state);\n\n// ---\n\n// from\n\nextern unsigned int ip6t_do_table(struct sk_buff *skb,\n          const struct nf_hook_state *state,\n          struct xt_table *table);\n\n// to\n\nextern unsigned int ip6t_do_table(void *priv, struct sk_buff *skb,\n          const struct nf_hook_state *state);\n\n```\n\nAs a result, `skbtracer-iptables` has to prepare two versions of eBPF program\nfor kprobe on them.\n\n```C\n// \u003e= 5.16\n\nSEC(\"kprobe/ipt_do_table\")\nint BPF_KPROBE(k_ipt_do_table, struct xt_table *table,\n    struct sk_buff *skb,\n    const struct nf_hook_state *state)\n{\n    return __ipt_do_table_in(ctx, skb, state, table);\n};\n\n// \u003c 5.16\n\nSEC(\"kprobe/ipt_do_table\")\nint BPF_KPROBE(ipt_do_table_old, struct sk_buff *skb,\n    const struct nf_hook_state *state,\n    struct xt_table *table)\n{\n    return __ipt_do_table_in(ctx, skb, state, table);\n}\n```\n\nNote: confirm that you can kprobe the two functions:\n\n```bash\n# bpftrace -l 'k:ip*t_do_table'\nkprobe:ip6t_do_table\nkprobe:ipt_do_table\n```\n\n## Build and run\n\nBuilding requires clang and llvm.\n\n```bash\n# git clone https://github.com/Asphaltt/skbtracer-iptables.git\n# cd skbtracer-iptables\n# go generate\n# go build\n# ./skbtracer-iptables --proto icmp\n2023/02/27 13:35:07 Attached kprobe(ipt_do_table)\n2023/02/27 13:35:07 Attached kretprobe(ipt_do_table)\n2023/02/27 13:35:07 Attached kprobe(ip6t_do_table)\n2023/02/27 13:35:07 Attached kretprobe(ip6t_do_table)\nTIME       SKB                  NETWORK_NS   PID      CPU    INTERFACE          DEST_MAC           IP_LEN PKT_INFO                                               IPTABLES_INFO\n[00:00:56] [0xffff95398a31a200] [4026531840] 2347     0      nil                61:6e:37:38:78:78  84     I_request:10.0.2.15-\u003e8.8.8.8                           pkt_type=HOST iptables=[pf=PF_INET, table=nat hook=OUTPUT verdict=ACCEPT]\n[00:00:56] [0xffff95398a31a200] [4026531840] 2347     0      nil                61:6e:37:38:78:78  84     I_request:10.0.2.15-\u003e8.8.8.8                           pkt_type=HOST iptables=[pf=PF_INET, table=filter hook=OUTPUT verdict=ACCEPT]\n[00:00:56] [0xffff95398a31a200] [4026531840] 2347     0      enp0s3             61:6e:37:38:78:78  84     I_request:10.0.2.15-\u003e8.8.8.8                           pkt_type=HOST iptables=[pf=PF_INET, table=nat hook=POSTROUTING verdict=ACCEPT]\n[00:00:56] [0xffff953990ac5500] [4026531840] 0        3      enp0s3             08:00:27:ff:1e:ab  84     I_reply:8.8.8.8-\u003e10.0.2.15                             pkt_type=HOST iptables=[pf=PF_INET, table=filter hook=INPUT verdict=ACCEPT]\n[00:00:57] [0xffff95398a31ac00] [4026531840] 2347     0      nil                00:00:00:00:00:00  84     I_request:10.0.2.15-\u003e8.8.8.8                           pkt_type=HOST iptables=[pf=PF_INET, table=filter hook=OUTPUT verdict=ACCEPT]\n[00:00:57] [0xffff953990ac5100] [4026531840] 0        3      enp0s3             08:00:27:ff:1e:ab  84     I_reply:8.8.8.8-\u003e10.0.2.15                             pkt_type=HOST iptables=[pf=PF_INET, table=filter hook=INPUT verdict=ACCEPT]\n^C2023/02/27 13:35:19 Received signal, exiting program...\n```\n\n## License\n\nApache License 2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fasphaltt%2Fskbtracer-iptables","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fasphaltt%2Fskbtracer-iptables","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fasphaltt%2Fskbtracer-iptables/lists"}