4 ms·

Maybe I'm missing the point of bpfgen. What additional functionality does it provide over tcpdump? tcpdump -i eth0 -d dst 127.0.0.1 (000) ldh [12]

by bhickey 11y ago

Maybe I'm missing the point of bpfgen. What additional functionality does it provide over tcpdump? tcpdump -i eth0 -d dst 127.0.0.1 (000) ldh [12] (001) jeq #0x800 jt 2 jf 4 (002) ld [30] (003) jeq #0x7f000001 jt 8 jf 9 (004) jeq #0x806 jt 6 jf 5 (005) jeq #0x8035 jt 6 jf 9 (006) ld [38] (007) jeq #0x7f000001 jt 8 jf 9 (008) ret #65535 (009) ret #0

neopallium 11y ago
tcpdump is just for filtering and capture. BPF allows dropping packets based on complex matching rules. I would say that BPF is closer to iptables rules then tcpdump. Quote from the README: .... The aim of this tool is to help creating BPF rules that will match (and drop) malicious traffic. I haven't used BPF before, because I haven't had a need to yet. But I have been very interested in BPF for some time now. I hope more tools are made to make it easier to use BPF.
- lobster_johnson 11y ago
  BPF is actually a tiny virtual machine (!) language designed to run securely in a kernel. This is very different from iptables, where everything has to be expressed as a rule ("policy") with a set of fixed parameters that match a packet. iptables has a way to jump around in the rule set ("chains"), but it's not quite Turing-complete. In Linux, BPF has been generalized (as eBPF, "extended BPF") to work not just with networking, but the kernel as a whole, though I'm not sure how extensive the set of available tracepoints is at the moment.
  - dsd2222 11y ago
    Normal BPF already worked with seccomp as well, which is outside of networking. But yes, eBPF is a major advancement, i.e. you can program eBPF code in a C language subset and compile it with LLVM. There's quite some possibilities already used in tracing and networking (here: tc classifier and actions and socket filters).
jsnell 11y ago
The pcap filter language isn't very powerful. Once you get outside of the primitives it supplies, even very simple things become hard or impossible. The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on. (I once wanted a pcap filter that matched SYN packets with a wscale option set; it ended up being a 8kB long filter due to needing to handle different ordering of variable sized TCP options. It would have been pretty trivial to do in raw BPF).
- bhickey 11y ago
  The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on. Ah-ha, thanks! I've written quite a bit of BPF but haven't dug too deeply into pcap filters. Based on the examples it looked redundant with the pcap language.

by bhickey 11y ago

neopallium 11y ago

tcpdump is just for filtering and capture. BPF allows dropping packets based on complex matching rules. I would say that BPF is closer to iptables rules then tcpdump. Quote from the README: .... The aim of this tool is to help creating BPF rules that will match (and drop) malicious traffic. I haven't used BPF before, because I haven't had a need to yet. But I have been very interested in BPF for some time now. I hope more tools are made to make it easier to use BPF.

lobster_johnson 11y ago
BPF is actually a tiny virtual machine (!) language designed to run securely in a kernel. This is very different from iptables, where everything has to be expressed as a rule ("policy") with a set of fixed parameters that match a packet. iptables has a way to jump around in the rule set ("chains"), but it's not quite Turing-complete. In Linux, BPF has been generalized (as eBPF, "extended BPF") to work not just with networking, but the kernel as a whole, though I'm not sure how extensive the set of available tracepoints is at the moment.
- dsd2222 11y ago
  Normal BPF already worked with seccomp as well, which is outside of networking. But yes, eBPF is a major advancement, i.e. you can program eBPF code in a C language subset and compile it with LLVM. There's quite some possibilities already used in tracing and networking (here: tc classifier and actions and socket filters).

jsnell 11y ago

The pcap filter language isn't very powerful. Once you get outside of the primitives it supplies, even very simple things become hard or impossible. The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on. (I once wanted a pcap filter that matched SYN packets with a wscale option set; it ended up being a 8kB long filter due to needing to handle different ordering of variable sized TCP options. It would have been pretty trivial to do in raw BPF).

bhickey 11y ago
The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on. Ah-ha, thanks! I've written quite a bit of BPF but haven't dug too deeply into pcap filters. Based on the examples it looked redundant with the pcap language.