3 ms·
tcpdump is just for filtering and capture. BPF allows dropping packets based on complex matching rules. I would say that BPF is closer to iptables rules then
by neopallium 11y ago
tcpdump is just for filtering and capture. BPF allows dropping packets based on complex matching rules.
I would say that BPF is closer to iptables rules then tcpdump.
Quote from the README:
.... The aim of this tool is to help creating BPF rules that will match (and drop) malicious traffic.
I haven't used BPF before, because I haven't had a need to yet. But I have been very interested in BPF for some time now. I hope more tools are made to make it easier to use BPF.
- lobster_johnson 11y agoBPF is actually a tiny virtual machine (!) language designed to run securely in a kernel. This is very different from iptables, where everything has to be expressed as a rule ("policy") with a set of fixed parameters that match a packet. iptables has a way to jump around in the rule set ("chains"), but it's not quite Turing-complete. In Linux, BPF has been generalized (as eBPF, "extended BPF") to work not just with networking, but the kernel as a whole, though I'm not sure how extensive the set of available tracepoints is at the moment.
- dsd2222 11y agoNormal BPF already worked with seccomp as well, which is outside of networking. But yes, eBPF is a major advancement, i.e. you can program eBPF code in a C language subset and compile it with LLVM. There's quite some possibilities already used in tracing and networking (here: tc classifier and actions and socket filters).