4 ms·

Accurate, low-overhead per process bandwidth monitoring in 40 lines of bpftrace

• thomashabets2 5y ago
  Nice. I have done similar for measuring per-device bandwidth of USB devices with bpftrace: https://blog.habets.se/2020/08/Measuring-USB-with-bpftrace.html https://blog.habets.se/2020/08/Measuring-USB-with-bpftrace.h...
• tkinom 5y ago
  After I see app's bandwidth usage, if I want to block that app's traffic, what's the best way to do that?
  • effie 5y ago
    You have to run the app with dedicated UID, then iptables -I OUTPUT -m owner --uid-owner <UID> -j DROP ip6tables -I OUTPUT -m owner --uid-owner <UID> -j DROP
  • mircea 5y ago
    Run the app in a separate netns and then you can create iptables/netfilter rules that match on that netns.
• effie 5y ago
  Not working on 4.19. # bpftrace socktraf.bt 12.12-160: syntax error, unexpected struct
• londons_explore 5y ago
  Once tools using bpftrace become common, refactoring the Linux kernel will never happen again. It would break too many tools that depend on exact internal function names existing.
  • SubjectToChange 5y ago
    bpftrace is for ad-hoc dynamic tracing, other programs shouldn't call directly out to it. Anyway, other dynamic tracing frameworks like SystemTap or LTTng have been using tracepoints, kprobes, and kretprobes for over fifteen years now. Refactoring kernel code isn't going to suddenly become impossible just because of tools new tools like bpftrace.