4 ms·

Show HN: eBPF-powered L4 package dropper

• artemish 4y ago
  Neat! So this is a tool you can use to implement firewall-ish rules and drop packets from certain IP addresses. It looks like the actual XDP code is written in C, and somehow makes its way into the Go program, is this the way EBPF tools are usually implemented in Go?
  • boratanrikulu 4y ago
    Thank you! Yes, AFAIK There's no way to code the eBPF part in Go, so I used C without loops. Go part handles loading the eBPF and utilizing the maps. Btw, Rust hcan be used as eBPF code language since It was added to the Kernel.
• muxamilian 4y ago
  With L4 you mean the transport layer? I’m a bit confused because in your examples you show layer 3 (IP). This eBPF-based package dropper using machine learning (decision tree) might be of interest to you: https://github.com/CN-TU/machine-learning-in-ebpf https://github.com/CN-TU/machine-learning-in-ebpf
  • boratanrikulu 4y ago
    I meant Transport Layer packages. > https://github.com/CN-TU/machine-learning-in-ebpf https://github.com/CN-TU/machine-learning-in-ebpf Thank you! I'll take a look.