machine-learning-in-ebpf
This repository contains the code for the paper "A flow-based IDS using Machine Learning in eBPF", Contact: Maximilian Bachl (by CN-TU)
pwru
Packet, where are you? -- eBPF-based Linux kernel networking debugger (by cilium)
machine-learning-in-ebpf | pwru | |
---|---|---|
3 | 7 | |
76 | 2,470 | |
- | 4.5% | |
4.9 | 9.1 | |
18 days ago | 4 days ago | |
C | C | |
GNU General Public License v3.0 only | Apache License 2.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
machine-learning-in-ebpf
Posts with mentions or reviews of machine-learning-in-ebpf.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-12-22.
-
Show HN: eBPF-powered L4 package dropper
I meant Transport Layer packages.
> https://github.com/CN-TU/machine-learning-in-ebpf
Thank you! I'll take a look.
-
A flow-based IDS using Machine Learning in eBPF
I’m not the post other but a coauthor of the paper. If there are some details missing in the paper, there’s also the open source implementation, also referenced in the paper: https://github.com/CN-TU/machine-learning-in-ebpf
pwru
Posts with mentions or reviews of pwru.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-04-04.
- GitHub - cilium/pwru: Packet, where are you? -- eBPF-based Linux kernel networking debugger
- cilium/pwru: Packet, where are you? -- eBPF-based Linux kernel networking debugger
-
Packet, where are you? – eBPF-based Linux kernel networking debugger
if you have a recent enough kernel, this change https://github.com/cilium/pwru/pull/148 means that it will print the reason the packet was dropped in the output - see https://lwn.net/Articles/885729/
There's a whole heap of reasons a packet can be dropped:
-
A list of new(ish) command line tools – Julia Evans
[pwru](https://github.com/cilium/pwru) is a fun new tool from the Cilium folks for tracing network packets in the kernel. Like tcpdump but it shows you the full path including kernel syscalls. Lets you debug much deeper than "when the packet gets to this port it gets dropped".
-
Better visibility into Linux packet-dropping decisions
I recently came across another useful utility for debugging unexpected packet drops - PWRU[0] (Packet, Where Are You) by Cilium.
It uses eBPF to try to trace the path of the packet through the kernel. Haven't needed to use it yet, but it could have saved me a lot of trouble in the past.
[0]: https://github.com/cilium/pwru