4 ms·
Thr stark difference between Linux and macos is that ONLY macos can filter inbound Ether packets by its destination process ID. Becasue BSD raw socket rules.
by egberts1 2y ago
Thr stark difference between Linux and macos is that ONLY macos can filter inbound Ether packets by its destination process ID.
Becasue BSD raw socket rules.
That's how you get Sniffer to be performing waaaaay more intuitively on macos than at all on Linux.
- codetrotter 2y agoDo you have a link to Sniffer?
- tankenmate 2y agoYou can do the same on Linux, just not easily from the command line; ebpf however can do all this and more. Once you have built it you can just create a program that you can use from the command line. There are guides out there to show you how.[0] [0] https://www.datadoghq.com/blog/ebpf-guide/ https://www.datadoghq.com/blog/ebpf-guide/
- carlmr 2y agoI've been meaning to try out eBPF. I read a tutorial on writing a simple perf application in Rust, but I kind of lack the intuition to know what it's good for. Do you know a good overview of what can be done with eBPF?
- packetlost 2y agoThink of it like small, isolated programs that run in a VM that is managed by the kernel and has access to many kernel APIs and datastructures without needing to do syscalls. I believe they can both monitor and manipulate data as it flows through the OS primatives (sockets, file descriptors, etc.).
- Denvercoder9 2y agonftables supports matching by cgroups, which arguably is a better idea than process IDs. https://wiki.nftables.org/wiki-nftables/index.php/Matching_packet_metainformation#Matching_by_security_selectors https://wiki.nftables.org/wiki-nftables/index.php/Matching_p...