{"id":17774662,"url":"https://github.com/jiegec/hll_ebpf","last_synced_at":"2025-05-13T01:47:39.087Z","repository":{"id":68569835,"uuid":"137473581","full_name":"jiegec/hll_ebpf","owner":"jiegec","description":"Estimate the cardinality of TCP remote IPs","archived":false,"fork":false,"pushed_at":"2023-11-11T15:43:39.000Z","size":58,"stargazers_count":6,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-05-13T01:47:32.725Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jiegec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-06-15T10:16:37.000Z","updated_at":"2023-11-17T12:36:26.000Z","dependencies_parsed_at":"2024-10-26T22:03:08.359Z","dependency_job_id":"04171a9d-51e4-4dfd-8fbd-6090d3215f48","html_url":"https://github.com/jiegec/hll_ebpf","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jiegec%2Fhll_ebpf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jiegec%2Fhll_ebpf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jiegec%2Fhll_ebpf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jiegec%2Fhll_ebpf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jiegec","download_url":"https://codeload.github.com/jiegec/hll_ebpf/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253856615,"owners_count":21974576,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-26T21:51:54.214Z","updated_at":"2025-05-13T01:47:39.071Z","avatar_url":"https://github.com/jiegec.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"hll_epbf\n========================\n\n\nUse eBPF to log the src addrs of inbound packets, and dst addrs of outbound packets, and use hyperloglog for estimation.\n\nUsage\n========================\n\n```shell\n$ make load\n# compiles the bpf and loads it into your kernel\n$ make read\n# reads the counters collected by the bpf program and estimate the cardinality by hyperloglog\n78 # inbound\n998 # outbound\n```\n\nHow can it be useful?\n======================\n\nFor example, DDoS detection.\n\n```\n$ sudo ./read_result watch 5\n# Output the hll estimated in/out remote addrs within each 5 seconds\n```\n\nIf you use nmap to scan, you can see a spike in the numbers.\nIf you are DDos-ed, you can see the number get quite large.\nThus, it can be used for a efficient DDoS detection metric.\n\nLicense\n======================\n\nLicensed under GPL v3, with some sources taken from Linux.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjiegec%2Fhll_ebpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjiegec%2Fhll_ebpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjiegec%2Fhll_ebpf/lists"}