Posts

Showing posts with the label eBPF

Fix: Tracing with eBPF tracepoint "netif_receive_skb" for multiple NICs

 When tracing with eBPF tracepoints like "netif_receive_skb" for multiple NICs, you can leverage eBPF's flexibility to filter packets based on the NIC's name or any other relevant attribute. Here's a general approach: 1. **Identify the NICs**: You need to know the names of the NICs you want to trace. You can list the NICs on your system using a command like `ip link` or `ifconfig`. 2. **Filter Packets by NIC Name**: In your eBPF program, you can filter packets based on the NIC's name using the `ifindex` attribute provided by the tracepoint. Here's an example eBPF program to filter packets from a specific NIC:    ```c    #include <linux/if.h>    #include <linux/skbuff.h>        SEC("netif/receive_skb")    int netif_receive_skb(struct __sk_buff *skb) {        struct net_device *dev;            // Get the network device associated with the packet        dev = bpf_get_current_task()->real_dev;            // Filter packets from a specif