{"id":34246496,"url":"https://github.com/f18m/ebpf-netflow-tracer","last_synced_at":"2026-04-24T13:31:36.496Z","repository":{"id":326218186,"uuid":"1104576135","full_name":"f18m/ebpf-netflow-tracer","owner":"f18m","description":"A small eBPF utility to find out active TCP connections and depict them using Graphviz/DOT","archived":false,"fork":false,"pushed_at":"2026-01-19T13:31:32.000Z","size":141,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-22T12:12:19.633Z","etag":null,"topics":["ebpf"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/f18m.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-26T11:55:05.000Z","updated_at":"2025-11-26T15:05:15.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/f18m/ebpf-netflow-tracer","commit_stats":null,"previous_names":["f18m/ebpf-netflow-tracer"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/f18m/ebpf-netflow-tracer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f18m%2Febpf-netflow-tracer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f18m%2Febpf-netflow-tracer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f18m%2Febpf-netflow-tracer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f18m%2Febpf-netflow-tracer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/f18m","download_url":"https://codeload.github.com/f18m/ebpf-netflow-tracer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f18m%2Febpf-netflow-tracer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32225732,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-24T13:21:15.438Z","status":"ssl_error","status_checked_at":"2026-04-24T13:21:15.005Z","response_time":64,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf"],"created_at":"2025-12-16T07:07:51.481Z","updated_at":"2026-04-24T13:31:36.491Z","avatar_url":"https://github.com/f18m.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Connection Tracing Overview\n\nThis repository contains two components that work together to observe TCPv4 activity on a system and transform those observations into a visual network graph:\n\n1. **ebpf_netflow_tracer** — a bpftrace program that monitors TCP connections and prints structured connection events.  \n2. **net_visualizer** — a Golang tool that consumes the ebpf_netflow_tracer output and generates a DOT-format graph representing process-to-process communication.\n\n---\n\n## ebpf_netflow_tracer\n\nThe **ebpf_netflow_tracer** component is a small eBPF/bpftrace script designed to observe TCPv4 connections made by processes running on the system. It attaches to relevant kernel functions to capture connection attempts and reports each observed event in a consistent, structured format.\n\n### What ebpf_netflow_tracer does\n\n- Monitors IPv4 TCP connections initiated or accepted by user-space processes.\n- Captures information about both endpoints of the connection.\n- Associates each network event with metadata about the process responsible for it.\n- Outputs each connection as a single line of text so it can be streamed or piped into other tools.\n\n### ebpf_netflow_tracer output format\n\nEach observed connection is printed as:\n\n```\n\u003cremote-ip\u003e:\u003cremote-port\u003e\u003cdirection-arrow\u003e\u003clocal-ip\u003e:\u003clocal-port\u003e|\u003cprocess metadata\u003e\n```\n\nWhere:\n\n- **remote-ip:remote-port** — the peer endpoint.  \n- **local-ip:local-port** — the local endpoint.  \n- **direction-arrow** — indicates the direction of the connection:  \n  - `→` for outgoing connections  \n  - `←` for incoming connections  \n- **process metadata** — information such as PID, executable name, or command-line details (depending on the tracer implementation).\n\nAn example trace is provided in `net_visualizer/example.trace`.\n\n---\n\n## net_visualizer (Golang)\n\nThe **net_visualizer** is a Golang program that consumes the line-oriented output from **ebpf_netflow_tracer** and builds a directed graph representing communication between processes. The graph is emitted in DOT format, which can be used with Graphviz and similar tools for visualization.\n\n### What net_visualizer does\n\n- Reads ebpf_netflow_tracer connection events from standard input.\n- Parses each connection line to extract:\n  - Local and remote addresses  \n  - Direction of communication  \n  - Process identity or metadata  \n- Treats each process as a graph node.\n- Treats each observed TCP connection as a directed edge.\n- Deduplicates edges so repeated connections do not clutter the graph.\n- Emits a DOT graph describing the connectivity.\n\n### Input\n\nThe program expects streamed or file-based ebpf_netflow_tracer output, for example:\n\n```\ncat example.trace | go run main.go\n```\n\nEach line must match the ebpf_netflow_tracer output format described above.\n\n### Output\n\nThe output is a DOT-format graph describing:\n\n- Each unique process as a node.\n- Each observed (and deduplicated) TCP connection as a directed edge from source process to destination process.\n\nThe output can be piped directly into Graphviz, for example:\n\n```\ngo run main.go \u003c example.trace | dot -Tpng -o graph.png\n```\n\nExample output:\n\n\u003cimg title=\"Example output\" alt=\"output\" src=\"net_visualizer/graph.png\"\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ff18m%2Febpf-netflow-tracer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ff18m%2Febpf-netflow-tracer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ff18m%2Febpf-netflow-tracer/lists"}