datadog / ebpf-training

eBPF Workshops

This repository contains the code that goes along with our blog posts about eBPF.

Workshops:

1. Simple HTTP traffic captures using BCC
2. A gentle introduction to XDP
3. A step by step tutorial for simple HTTP trafic capturing
4. Audit and Deny access to sensitive file
5. Capture TLS traffic

ebpf-training's Issues

Tutorials Broken Due to Missing `seekret` container registry

I assume this is a result of Seekret being acquired by DataDog. The tutorials reference a container image at gcr.io/seekret/ebpf-training-setup, but this registry can no longer be found.

Instead of using that image, I'll build my own locally for doing the tutorial. That is fine, I just wanted to let you know so you can update your tutorials accordingly.

a question about running ebpf on openwrt

Hi,

It is really a good repo for new man. I read the README in this repo, but I found the tutorials does not fit any Linux, openwrt for example. I tried the steps described , but I found it really tough to run eBPF on openwrt. Do you have any thoughts? :(

Best regards

How can I capture all incoming and outgoing HTTP traffic?

feat: add support for tracing ingress traffic where connection is alive

I've tried workshop-1 and used curl to hit the request. I was able to see the captured request and response. But when I tried with Postman or any other client that supports connection:keep-alive. I was not able to capture it adequately. After debugging I found that the close system call doesn't trigger for every request in the latter case.

We need to find a way to ensure we can capture the traffic no matter how it's sent.

docker run error

hi，when i in docker exec go run main.go ./sourcecode.c，the error is：
root@ubuntu:/src/workshop1/capture-traffic# go run main.go ./sourcecode.c
go: downloading github.com/iovisor/gobpf v0.2.0
go: downloading golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9
github.com/iovisor/gobpf/bcc
/go/pkg/mod/github.com/iovisor/[email protected]/bcc/module.go:230:28: not enough arguments in call to _C2func_bcc_func_load
have (unsafe.Pointer, _Ctype_int, *_Ctype_char, *_Ctype_struct_bpf_insn, _Ctype_int, *_Ctype_char, _Ctype_uint, _Ctype_int, *_Ctype_char, _Ctype_uint, nil)
want (unsafe.Pointer, _Ctype_int, *_Ctype_char, *_Ctype_struct_bpf_insn, _Ctype_int, *_Ctype_char, _Ctype_uint, _Ctype_int, *_Ctype_char, _Ctype_uint, *_Ctype_char, _Ctype_int)
how can i solve ？thanks！

Hi, can not get remote ip address?

Hi,
can not get remote ip address? thks