{"id":13540264,"url":"https://github.com/cloudflare/bpftools","last_synced_at":"2025-04-13T10:57:34.312Z","repository":{"id":16782266,"uuid":"19540597","full_name":"cloudflare/bpftools","owner":"cloudflare","description":"BPF Tools - packet analyst toolkit","archived":false,"fork":false,"pushed_at":"2024-09-25T04:23:00.000Z","size":141,"stargazers_count":1205,"open_issues_count":7,"forks_count":141,"subscribers_count":73,"default_branch":"master","last_synced_at":"2025-04-06T07:05:19.715Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cloudflare.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-BSD-CloudFlare","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-05-07T15:49:19.000Z","updated_at":"2025-04-04T02:22:43.000Z","dependencies_parsed_at":"2022-07-22T07:18:00.037Z","dependency_job_id":"e5e31501-1093-41a9-9f77-fed0b0cd3ebb","html_url":"https://github.com/cloudflare/bpftools","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudflare%2Fbpftools","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudflare%2Fbpftools/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudflare%2Fbpftools/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudflare%2Fbpftools/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cloudflare","download_url":"https://codeload.github.com/cloudflare/bpftools/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248703194,"owners_count":21148117,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:44.059Z","updated_at":"2025-04-13T10:57:34.287Z","avatar_url":"https://github.com/cloudflare.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"79499aeece9a2a9f64af6f61ee18cbea\"\u003e\u003c/a\u003e浏览嗅探\u0026\u0026流量拦截\u0026\u0026流量分析\u0026\u0026中间人","Python","\u003ca id=\"7bf0f5839fb2827fdc1b93ae6ac7f53d\"\u003e\u003c/a\u003e工具","Networking \u0026 Performance"],"sub_categories":["\u003ca id=\"99398a5a8aaf99228829dadff48fb6a7\"\u003e\u003c/a\u003e未分类-Network","\u003ca id=\"b346105580b0240d693020ce8719ebca\"\u003e\u003c/a\u003e未分类","Traffic Analysis \u0026 Filtering"],"readme":"BPF Tools\n=========\n\nIntroductory blog posts:\n\n  - http://blog.cloudflare.com/bpf-the-forgotten-bytecode/\n  - http://blog.cloudflare.com/introducing-the-bpf-tools/\n\n\nHere you can find a set of tool for analyzing and processing of pcap\ntraffic dumps. The aim of this tool is to help creating BPF rules that\nwill match (and drop) malicious traffic.\n\nTo run these scripts you will need:\n\n - Kernel headers (ideally from a 3.10+ kernel):\n\n        $ sudo apt-get install linux-headers-generic\n\n - Installed dependencies:\n\n        $ sudo apt-get install python-setuptools libpcap-dev \\\n                               libreadline-dev binutils-dev bison flex\n        $ sudo easy_install pcappy\n\n - Build the binary tools in `linux_tools` directory:\n\n        $ make\n\n\nBPF Tools repository contains a number simple Python scripts, some of\nthem focus on analyzing pcap files, others focus more on the BPF:\n\n - `pcap2hex`, `hex2pcap`\n - `parsedns`\n - `bpfgen`\n - `filter`\n - `iptables_bpf`, `iptables_bpf_chain`\n\n\nbpfgen\n======\n\nThe core script is `bpfgen` which generates the BPF bytecode. For more\ninformation please read:\n\n    $ ./bpfgen --help\n    $ ./bpfgen dns -- --help\n    $ ./bpfgen dns_validate -- --help\n    $ ./bpfgen suffix -- --help\n\n\niptables_bpf\n============\n\nThis script generates a simple bash script that contains iptables\nrules that drop traffic based on selected parameters.\n\nFor example, to generate a script dropping packets exactly to a domain\n\"example.com\" you can run:\n\n    $ ./iptables_bpf dns -- example.com\n    Generated file 'bpf_dns_ip4_example_com.sh'\n\nIf you want commands for IPv6 use `-6` flag:\n\n    $ ./iptables_bpf -6 dns -- example.com\n    Generated file 'bpf_dns_ip6_example_com.sh'\n\nThe rule can match any from a number listed domains:\n\n    $ ./iptables_bpf dns -- example.com example1.com example2.com\n    Generated file 'bpf_dns_ip4_example_com_example1_com_example2_com.sh'\n\nIf you want to match any subdomain you can use a star '*'. This will\nonly work if star is the only character in a domain part. Valid\nexamples:\n\n    $ ./iptables_bpf dns -- *.example.com\n    Generated file 'bpf_dns_ip4_any_example_com.sh'\n\n    $ ./iptables_bpf dns -- *.example.*.gov.de\n    Generated file 'bpf_dns_ip4_any_example_any_gov_de.sh'\n\n\nYou can run the generated script to apply the rule and match it\nagainst one or more flooded ip addresses:\n\n    $ sudo ./bpf_dns_ip4_example_com.sh 1.2.3.4/32\n\nTo remove the iptable rule simply specify `--delete`:\n\n    $ sudo ./bpf_dns_ip4_example_com.sh --delete\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudflare%2Fbpftools","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcloudflare%2Fbpftools","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudflare%2Fbpftools/lists"}