https://github.com/bwnetflow/bpf_flowexport

WIP - export flows directly from local interfaces using bpf
https://github.com/bwnetflow/bpf_flowexport

Last synced: about 17 hours ago
JSON representation

WIP - export flows directly from local interfaces using bpf

• Host: GitHub
• URL: https://github.com/bwnetflow/bpf_flowexport
• Owner: bwNetFlow
• License: gpl-3.0
• Created: 2021-10-13T11:24:48.000Z (about 3 years ago)
• Default Branch: master
• Last Pushed: 2022-05-15T11:22:24.000Z (over 2 years ago)
• Last Synced: 2024-11-11T06:42:33.563Z (about 2 months ago)
• Language: Go
• Size: 5.94 MB
• Stars: 0
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# BPF Export

This repo implements a packet dump from BPF and couples that with one of two applications:

## Flow Exporter

This exporter uses the format outlined by github.com/bwNetFlow/protobuf as an

output, which is very similar to github.com/netsampler/goflow2 format. I.e., no

actual Netflow or IPFIX is being generated.

At the moment, it does not support sampling and uses classic inactive/active

timeouts to decide when to export flows from its cache.

This is chiefly used by [bwnet's

flowpipeline](https://github.com/bwNetFlow/flowpipeline) to implement the `bpf`

segment as datasource.

## Prometheus Exporter

This exporter exposes a prometheus exporter endpoint at `:9999/metrics` with

some simple proof of concept metrics. This is generated solely on packet

headers and thus could be used to calculate statistics which would be impossible

by using kernel counters such as:

* inter packet arrivel times for specific flows

* micropeaks and burstiness of traffic

* traffic class analysis

However, the current version just exports packet and byte counts by etype and

protocol number.

## Capabilities

* `cap_sys_resource` is required to release the rlimit memlock which is

  necessary to be able to load BPF programs

* `cap_net_raw` is required to open raw sockets, to which our BPF program needs

  to attach

* `cap_perfmon` is required to create a kernel perf buffer for exporting packet

  data into user space

Full example:

```bash

sudo setcap cap_sys_resource,cap_net_raw,cap_perfmon+ep binary

```