Skip to content

Commit 1611601

Browse files
dkorunicdkorunic
committed
Initial Kprobes implementation. Revert XDP and TC PID-tracking code.
1 parent 74353f2 commit 1611601

18 files changed

+282485
-267
lines changed

‎.clang-format

+274
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
---
2+
Language: Cpp
3+
AccessModifierOffset: -2
4+
AlignAfterOpenBracket: Align
5+
AlignArrayOfStructures: None
6+
AlignConsecutiveAssignments:
7+
Enabled: false
8+
AcrossEmptyLines: false
9+
AcrossComments: false
10+
AlignCompound: false
11+
AlignFunctionPointers: false
12+
PadOperators: true
13+
AlignConsecutiveBitFields:
14+
Enabled: false
15+
AcrossEmptyLines: false
16+
AcrossComments: false
17+
AlignCompound: false
18+
AlignFunctionPointers: false
19+
PadOperators: false
20+
AlignConsecutiveDeclarations:
21+
Enabled: false
22+
AcrossEmptyLines: false
23+
AcrossComments: false
24+
AlignCompound: false
25+
AlignFunctionPointers: false
26+
PadOperators: false
27+
AlignConsecutiveMacros:
28+
Enabled: false
29+
AcrossEmptyLines: false
30+
AcrossComments: false
31+
AlignCompound: false
32+
AlignFunctionPointers: false
33+
PadOperators: false
34+
AlignConsecutiveShortCaseStatements:
35+
Enabled: false
36+
AcrossEmptyLines: false
37+
AcrossComments: false
38+
AlignCaseArrows: false
39+
AlignCaseColons: false
40+
AlignConsecutiveTableGenBreakingDAGArgColons:
41+
Enabled: false
42+
AcrossEmptyLines: false
43+
AcrossComments: false
44+
AlignCompound: false
45+
AlignFunctionPointers: false
46+
PadOperators: false
47+
AlignConsecutiveTableGenCondOperatorColons:
48+
Enabled: false
49+
AcrossEmptyLines: false
50+
AcrossComments: false
51+
AlignCompound: false
52+
AlignFunctionPointers: false
53+
PadOperators: false
54+
AlignConsecutiveTableGenDefinitionColons:
55+
Enabled: false
56+
AcrossEmptyLines: false
57+
AcrossComments: false
58+
AlignCompound: false
59+
AlignFunctionPointers: false
60+
PadOperators: false
61+
AlignEscapedNewlines: Right
62+
AlignOperands: Align
63+
AlignTrailingComments:
64+
Kind: Always
65+
OverEmptyLines: 0
66+
AllowAllArgumentsOnNextLine: true
67+
AllowAllParametersOfDeclarationOnNextLine: true
68+
AllowBreakBeforeNoexceptSpecifier: Never
69+
AllowShortBlocksOnASingleLine: Never
70+
AllowShortCaseExpressionOnASingleLine: true
71+
AllowShortCaseLabelsOnASingleLine: false
72+
AllowShortCompoundRequirementOnASingleLine: true
73+
AllowShortEnumsOnASingleLine: true
74+
AllowShortFunctionsOnASingleLine: All
75+
AllowShortIfStatementsOnASingleLine: Never
76+
AllowShortLambdasOnASingleLine: All
77+
AllowShortLoopsOnASingleLine: false
78+
AlwaysBreakAfterDefinitionReturnType: None
79+
AlwaysBreakBeforeMultilineStrings: false
80+
AttributeMacros:
81+
- __capability
82+
BinPackArguments: true
83+
BinPackParameters: true
84+
BitFieldColonSpacing: Both
85+
BraceWrapping:
86+
AfterCaseLabel: false
87+
AfterClass: false
88+
AfterControlStatement: Never
89+
AfterEnum: false
90+
AfterExternBlock: false
91+
AfterFunction: false
92+
AfterNamespace: false
93+
AfterObjCDeclaration: false
94+
AfterStruct: false
95+
AfterUnion: false
96+
BeforeCatch: false
97+
BeforeElse: false
98+
BeforeLambdaBody: false
99+
BeforeWhile: false
100+
IndentBraces: false
101+
SplitEmptyFunction: true
102+
SplitEmptyRecord: true
103+
SplitEmptyNamespace: true
104+
BreakAdjacentStringLiterals: true
105+
BreakAfterAttributes: Leave
106+
BreakAfterJavaFieldAnnotations: false
107+
BreakAfterReturnType: None
108+
BreakArrays: true
109+
BreakBeforeBinaryOperators: None
110+
BreakBeforeConceptDeclarations: Always
111+
BreakBeforeBraces: Attach
112+
BreakBeforeInlineASMColon: OnlyMultiline
113+
BreakBeforeTernaryOperators: true
114+
BreakConstructorInitializers: BeforeColon
115+
BreakFunctionDefinitionParameters: false
116+
BreakInheritanceList: BeforeColon
117+
BreakStringLiterals: true
118+
BreakTemplateDeclarations: MultiLine
119+
ColumnLimit: 80
120+
CommentPragmas: '^ IWYU pragma:'
121+
CompactNamespaces: false
122+
ConstructorInitializerIndentWidth: 4
123+
ContinuationIndentWidth: 4
124+
Cpp11BracedListStyle: true
125+
DerivePointerAlignment: false
126+
DisableFormat: false
127+
EmptyLineAfterAccessModifier: Never
128+
EmptyLineBeforeAccessModifier: LogicalBlock
129+
ExperimentalAutoDetectBinPacking: false
130+
FixNamespaceComments: true
131+
ForEachMacros:
132+
- foreach
133+
- Q_FOREACH
134+
- BOOST_FOREACH
135+
IfMacros:
136+
- KJ_IF_MAYBE
137+
IncludeBlocks: Preserve
138+
IncludeCategories:
139+
- Regex: '^"(llvm|llvm-c|clang|clang-c)/'
140+
Priority: 2
141+
SortPriority: 0
142+
CaseSensitive: false
143+
- Regex: '^(<|"(gtest|gmock|isl|json)/)'
144+
Priority: 3
145+
SortPriority: 0
146+
CaseSensitive: false
147+
- Regex: '.*'
148+
Priority: 1
149+
SortPriority: 0
150+
CaseSensitive: false
151+
IncludeIsMainRegex: '(Test)?$'
152+
IncludeIsMainSourceRegex: ''
153+
IndentAccessModifiers: false
154+
IndentCaseBlocks: false
155+
IndentCaseLabels: false
156+
IndentExternBlock: AfterExternBlock
157+
IndentGotoLabels: true
158+
IndentPPDirectives: None
159+
IndentRequiresClause: true
160+
IndentWidth: 2
161+
IndentWrappedFunctionNames: false
162+
InsertBraces: false
163+
InsertNewlineAtEOF: false
164+
InsertTrailingCommas: None
165+
IntegerLiteralSeparator:
166+
Binary: 0
167+
BinaryMinDigits: 0
168+
Decimal: 0
169+
DecimalMinDigits: 0
170+
Hex: 0
171+
HexMinDigits: 0
172+
JavaScriptQuotes: Leave
173+
JavaScriptWrapImports: true
174+
KeepEmptyLines:
175+
AtEndOfFile: false
176+
AtStartOfBlock: true
177+
AtStartOfFile: true
178+
LambdaBodyIndentation: Signature
179+
LineEnding: DeriveLF
180+
MacroBlockBegin: ''
181+
MacroBlockEnd: ''
182+
MainIncludeChar: Quote
183+
MaxEmptyLinesToKeep: 1
184+
NamespaceIndentation: None
185+
ObjCBinPackProtocolList: Auto
186+
ObjCBlockIndentWidth: 2
187+
ObjCBreakBeforeNestedBlockParam: true
188+
ObjCSpaceAfterProperty: false
189+
ObjCSpaceBeforeProtocolList: true
190+
PackConstructorInitializers: BinPack
191+
PenaltyBreakAssignment: 2
192+
PenaltyBreakBeforeFirstCallParameter: 19
193+
PenaltyBreakComment: 300
194+
PenaltyBreakFirstLessLess: 120
195+
PenaltyBreakOpenParenthesis: 0
196+
PenaltyBreakScopeResolution: 500
197+
PenaltyBreakString: 1000
198+
PenaltyBreakTemplateDeclaration: 10
199+
PenaltyExcessCharacter: 1000000
200+
PenaltyIndentedWhitespace: 0
201+
PenaltyReturnTypeOnItsOwnLine: 60
202+
PointerAlignment: Right
203+
PPIndentWidth: -1
204+
QualifierAlignment: Leave
205+
ReferenceAlignment: Pointer
206+
ReflowComments: true
207+
RemoveBracesLLVM: false
208+
RemoveParentheses: Leave
209+
RemoveSemicolon: false
210+
RequiresClausePosition: OwnLine
211+
RequiresExpressionIndentation: OuterScope
212+
SeparateDefinitionBlocks: Leave
213+
ShortNamespaceLines: 1
214+
SkipMacroDefinitionBody: false
215+
SortIncludes: CaseSensitive
216+
SortJavaStaticImport: Before
217+
SortUsingDeclarations: LexicographicNumeric
218+
SpaceAfterCStyleCast: false
219+
SpaceAfterLogicalNot: false
220+
SpaceAfterTemplateKeyword: true
221+
SpaceAroundPointerQualifiers: Default
222+
SpaceBeforeAssignmentOperators: true
223+
SpaceBeforeCaseColon: false
224+
SpaceBeforeCpp11BracedList: false
225+
SpaceBeforeCtorInitializerColon: true
226+
SpaceBeforeInheritanceColon: true
227+
SpaceBeforeJsonColon: false
228+
SpaceBeforeParens: ControlStatements
229+
SpaceBeforeParensOptions:
230+
AfterControlStatements: true
231+
AfterForeachMacros: true
232+
AfterFunctionDefinitionName: false
233+
AfterFunctionDeclarationName: false
234+
AfterIfMacros: true
235+
AfterOverloadedOperator: false
236+
AfterPlacementOperator: true
237+
AfterRequiresInClause: false
238+
AfterRequiresInExpression: false
239+
BeforeNonEmptyParentheses: false
240+
SpaceBeforeRangeBasedForLoopColon: true
241+
SpaceBeforeSquareBrackets: false
242+
SpaceInEmptyBlock: false
243+
SpacesBeforeTrailingComments: 1
244+
SpacesInAngles: Never
245+
SpacesInContainerLiterals: true
246+
SpacesInLineCommentPrefix:
247+
Minimum: 1
248+
Maximum: -1
249+
SpacesInParens: Never
250+
SpacesInParensOptions:
251+
ExceptDoubleParentheses: false
252+
InCStyleCasts: false
253+
InConditionalStatements: false
254+
InEmptyParentheses: false
255+
Other: false
256+
SpacesInSquareBrackets: false
257+
Standard: Latest
258+
StatementAttributeLikeMacros:
259+
- Q_EMIT
260+
StatementMacros:
261+
- Q_UNUSED
262+
- QT_REQUIRE_VERSION
263+
TableGenBreakInsideDAGArg: DontBreak
264+
TabWidth: 8
265+
UseTab: Never
266+
VerilogBreakBetweenInstancePorts: true
267+
WhitespaceSensitiveMacros:
268+
- BOOST_PP_STRINGIZE
269+
- CF_SWIFT_NAME
270+
- NS_SWIFT_NAME
271+
- PP_STRINGIZE
272+
- STRINGIZE
273+
...
274+

‎.prettierignore

Whitespace-only changes.

‎README.md

+11-10
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,15 @@ In case of XDP, not all NIC drivers support **Native XDP** (XDP program is loade
3333

3434
The following table maps features, requirements and expected performance for described modes:
3535

36-
| Capture type | Ingress | Egress | Performance | Kernel required | SmartNIC required |
37-
| --------------------------------------------------- | ------- | ------ | -------------- | --------------- | ----------------- |
38-
| Generic [PCAP](https://github.com/dkorunic/pktstat) | Yes | Yes | Low | Any | No |
39-
| [AF_PACKET](https://github.com/dkorunic/pktstat) | Yes | Yes | Medium | v2.2 | No |
40-
| TC | Yes | Yes | **High** | v6.6 | No |
41-
| XDP Generic | Yes | **No** | **High** | v5.9 | No |
42-
| XDP Native | Yes | **No** | **Very high** | v5.9 | No |
43-
| XDP Offloaded | Yes | **No** | **Wire speed** | v5.9 | **Yes** |
36+
| Capture type | Ingress | Egress | Performance | Process tracking | Kernel required | SmartNIC required |
37+
| --------------------------------------------------- | ------- | ------ | -------------- | ---------------- | --------------- | ----------------- |
38+
| Generic [PCAP](https://github.com/dkorunic/pktstat) | Yes | Yes | Low | No | Any | No |
39+
| [AF_PACKET](https://github.com/dkorunic/pktstat) | Yes | Yes | Medium | No | v2.2 | No |
40+
| Kprobes | Yes | Yes | Medium+ | **Yes** | v2.6 | No |
41+
| TC | Yes | Yes | **High** | No | v6.6 | No |
42+
| XDP Generic | Yes | **No** | **High** | No | v5.9 | No |
43+
| XDP Native | Yes | **No** | **Very high** | No | v5.9 | No |
44+
| XDP Offloaded | Yes | **No** | **Wire speed** | No | v5.9 | **Yes** |
4445

4546
A list of XDP compatible drivers follows (and it is not necessarily up-to-date):
4647

@@ -57,7 +58,7 @@ FLAGS
5758
-?, --help display help
5859
-j, --json if true, output in JSON format
5960
-x, --xdp if true, use XDP instead of TC (this disables egress statistics)
60-
-p, --pid if true, use process ID for packets (works with TC only)
61+
-k, --kprobes if true, use kprobes for per-proces TCP/UDP statistics
6162
--version display program version
6263
-i, --iface STRING interface to read from (default: eth0)
6364
--xdp_mode STRING XDP attach mode (auto, generic, native or offload; native and offload require NIC driver support) (default: auto)
@@ -74,7 +75,7 @@ With `--xdp` program will switch from TC eBPF mode to XDP eBPF mode, working in
7475
7576
Additionally it is possible to change XDP attach mode with `--xdp_mode` from `auto` (best-effort between native and generic) to `native` or `offload`, for NIC drivers that support XDP or even NICs that have hardware XDP support.
7677
77-
With `--pid` it is also possible to enable process ID (PID) tracking. If packet processing is triggered by user-space process, we are able to display process ID, but in case the packet is processed by kernel (forwarding, routing, kernel-generated packets) PID will be zero. Additionally, PID tracking works only in TC eBPF mode.
78+
With `--kprobes` program will switch to Kprobe mode and track TCP and UDP traffic per process. Performance will be even more degraded compared to TC and XDP mode, but all per-PID traffic will be visible, inside of all Cgroups, containers, K8s pods etc.
7879
7980
## Star History
8081

0 commit comments

Comments
 (0)