bcc
picosnitch
bcc | picosnitch | |
---|---|---|
71 | 33 | |
19,499 | 586 | |
1.0% | - | |
9.2 | 8.6 | |
4 days ago | 4 months ago | |
C | Python | |
Apache License 2.0 | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
bcc
-
eBPF: Unleashing Kernel Magic for Modern Infrastructure
But wait, there's more! Enter the BCC toolkit and library, your trusty sidekick in simplifying the arcane art of writing eBPF applications. With BCC by your side, you'll be wielding eBPF like a seasoned pro in no time.
-
Linux: Easy Keylogger with eBPF (2018)
Nice - I normally use [bash-readline](https://github.com/iovisor/bcc/blob/master/tools/bashreadlin...) when coworking/co-inhabiting a server or training someone.
-
eBPF Documentary
One of the big wins is not so much “build and run your own stuff” but there are very nice low-cost (in terms of compute) performance utilities built on eBPF
https://github.com/iovisor/bcc
There are so many utilities in that list; there’s a diagram midway down the readme which tries to help show their uses. bcc-tools should be available in any distro.
Also, Brendan Gregg does a ton of performance stuff that is worth knowing about if you check out his other work. Not eBPF only. Flame graphs are useful.
- Bpftop: Streamlining eBPF performance optimization
-
eBPF Tutorial by Example 16: Monitoring Memory Leaks
Reference: https://github.com/iovisor/bcc/blob/master/libbpf-tools/memleak.c
- eBPF Tutorial by Example 9: Capturing Scheduling Latency and Recording as Histogram
-
Uprobes Siblings - Capturing HTTPS Traffic: A Rust and eBPF Odyssey
In this article, we'll build a basic version of an HTTPS sniffer, inspired by bcc-sslsniff.py, but we'll use Rust and Aya. We're going to demonstrate the capabilities of uprobes by employing uprobe and uretprobe along with familiar maps like PerCpuArray, HashMap, and PerEventArray. This will be a straightforward example to help us explore how uprobes function.
-
Issue XDP_REDIRECT on other interface in the same namespace
As xpd program I am using the BCC example xdp_redirect_map.py in skb mode as my NIC does not support native mode, attaching the program to veth2 and a dummy function to veth3
-
Linux runtime security agent powered by eBPF
https://github.com/iovisor/bcc/blob/master/docs/reference_gu...
- eBPF Practical Tutorial: Capturing SSL/TLS Plain Text Data Using uprobe
picosnitch
-
Linux runtime security agent powered by eBPF
Yep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit.
[1] https://github.com/elesiuta/picosnitch
-
Monitor bandwidth usage with bandwhich (and build a snap package of it)
Similar to bandwhich, I recently created a snap of my own bandwidth monitor, picosnitch [1]. However I was only able to get it working with classic confinement (so it can't be published on the store) due to there being no snap interfaces for fanotify or BPF kfuncs.
I already packaged it for nearly every distro, but unfortunately most don't have dash [2] in their repos so the user needs to install it separately, and I was hoping that snap would be an easier solution for that.
[1] https://github.com/elesiuta/picosnitch/blob/master/snap/snap...
[2] https://repology.org/project/python:dash/versions
-
What kind of applications are missing from the Linux ecosystem?
I created picosnitch which can do this
-
gnome-shell Runaway Bandwidth - More in Comments
If you're still having this issue, you can try picosnitch (I recently made it available in copr).
-
Help identifying which process is sending network requests
You can use picosnitch for this, I'm the developer and this is exactly the use case I had in mind when designing it (24/7 monitoring of traffic on a per executable basis, primarily in containerized environments).
-
Little Snitch Mini
I wrote picosnitch [1] which has the same notification and bandwidth monitoring features, however it doesn't block traffic for a couple reasons: avoiding scope creep so I can focus on more reliable detection and do things like hash every executable, which makes it harder to block traffic in a timely fashion.
https://github.com/elesiuta/picosnitch
-
System monitor that lists network usage for each process
I also wrote a program (picosnitch) which is newer than that list and has a bunch of features none of those other tools have, in case you're interested in checking it out!
-
linux security
which basically says launchpad builds the package directly from that repository, which states: This repository is an import of the Git repository at https://github.com/elesiuta/picosnitch.git.
-
Linux software list. Discussion and advice welcome!
picosnitch - monitors and hashes programs that connect to the internet, and can check them with VirusTotal.
-
What's your goto open source network & bandwidth monitors
For Linux, I created picosnitch which does exactly what you're looking for.
What are some alternatives?
libbpf - Automated upstream mirror for libbpf stand-alone build.
opensnitch - OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
bpftrace - High-level tracing language for Linux eBPF [Moved to: https://github.com/bpftrace/bpftrace]
goflow2 - High performance sFlow/IPFIX/NetFlow Collector
ebpf-for-windows - eBPF implementation that runs on top of Windows
ElastiFlow - Network flow analytics (Netflow, sFlow and IPFIX) with the Elastic Stack
zfs - OpenZFS on Linux and FreeBSD
How-To-Secure-A-Linux-Server - An evolving how-to guide for securing a Linux server.
linux - Linux kernel source tree
conntrack_exporter - Prometheus exporter for tracking network connections
nokogiri-rust - Ruby FFI wrapper around scraper crate to be used instead of Nokogiri. Status: proof of concept.
nsntrace - Perform network trace of a single process by using network namespaces.