{"repo":"dkorunic/pktstat-bpf","free":true,"listed":false,"github":"https://github.com/dkorunic/pktstat-bpf","clone":"git clone https://github.com/dkorunic/pktstat-bpf.git","description":"eBPF-based Ethernet traffic monitor using TC, XDP, kprobes and cgroups","language":"C","stars":150,"topics":["linux","networking","packet","packet-capture","terminal","network","tcpdump","traffic","xdp","bpf"],"license":"MIT","category":"networking-infra","readme_excerpt":"pktstat-bpf About pktstat-bpf is a lightweight replacement for the ncurses/libpcap-based pktstat, powered by Linux eBPF (extended Berkeley Packet Filter). It can gather packet statistics even under very high traffic volumes — typically several million packets per second on an average server. In high-volume scenarios such as DoS attacks, traditional packet capture solutions often become unreliable due to packet loss; eBPF-based capture is a more robust alternative. At the end of execution, the program displays per-IP and per-protocol statistics — including L7 protocol identification for HTTP, TLS, QUIC, SSH, RDP, PostgreSQL, MQTT, WireGuard, and Memcached — sorted by per-connection bitrate, packet count, and (source IP:port, destination IP:port) tuples. The program consists of eBPF code written in C and a pure-Go userland component that parses and displays final IP/port/protocol/bitrate statistics. The Go component uses the cilium/ebpf library to load and run the eBPF program and to interact with the eBPF map. By default, the eBPF component uses TC (Traffic Control) eBPF hooks with TCX attaching, requiring at minimum Linux kernel v6.6 , and collects both ingress and egress traffic statistics for TCP, UDP, ICMPv4, ICMPv6, ARP, IPSEC (ESP and AH), GRE, and OSPF. It can also switch to the faster XDP (eXpress Data Path) hook at the cost of losing egress statistics , since XDP operates only in the ingress path. XDP mode requires at minimum Linux kernel v5.9 due to its program-to-in","default_branch":null,"files":null,"tree":[],"storefront":"/r/dkorunic","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/dkorunic/pktstat-bpf/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}