https://github.com/jiegec/hll_ebpf
Estimate the cardinality of TCP remote IPs
https://github.com/jiegec/hll_ebpf
Last synced: about 1 year ago
JSON representation
Estimate the cardinality of TCP remote IPs
- Host: GitHub
- URL: https://github.com/jiegec/hll_ebpf
- Owner: jiegec
- License: gpl-3.0
- Created: 2018-06-15T10:16:37.000Z (about 8 years ago)
- Default Branch: master
- Last Pushed: 2023-11-11T15:43:39.000Z (over 2 years ago)
- Last Synced: 2025-05-13T01:47:32.725Z (about 1 year ago)
- Language: C
- Homepage:
- Size: 56.6 KB
- Stars: 6
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: COPYING
Awesome Lists containing this project
README
hll_epbf
========================
Use eBPF to log the src addrs of inbound packets, and dst addrs of outbound packets, and use hyperloglog for estimation.
Usage
========================
```shell
$ make load
# compiles the bpf and loads it into your kernel
$ make read
# reads the counters collected by the bpf program and estimate the cardinality by hyperloglog
78 # inbound
998 # outbound
```
How can it be useful?
======================
For example, DDoS detection.
```
$ sudo ./read_result watch 5
# Output the hll estimated in/out remote addrs within each 5 seconds
```
If you use nmap to scan, you can see a spike in the numbers.
If you are DDos-ed, you can see the number get quite large.
Thus, it can be used for a efficient DDoS detection metric.
License
======================
Licensed under GPL v3, with some sources taken from Linux.