Capturing incoming packets about xdpcap

[arthurfabre]

Hi, thanks for the feedback! Unfortunately due to the design of xdpcap, packets can only be captured after the instrumented XDP program has been run. This allows the packet to be filtered / matched in XDP, which avoids copying all packets. You could copy all incoming packets into a perf ring buffer, but we don't have an easy way of associating the input and output packets.

With more cooperation from the daemon loading the eBPF programs into the kernel, we think it should be possible to capture the original incoming packets, but we haven't implemented anything yet.

If your program is only encapsulating packets (for example in GRE / GUE), a (poorly documented) tool in this repo, bpfoff can add match packets with a set of fixed offsets. For example if your encapsulation format adds a fixed header of either 50 or 54 bytes before the original IP packet, you could:

sudo xdpcap /run/xdpd/bpffs/l4lb - "$(bpfoff 50,54 "ip and tcp port 443")"