Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ebpf plugin + parser #1196

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

vpidatala94
Copy link

@vpidatala94 vpidatala94 commented Jan 7, 2025

Description

For POC purposes only - DO NOT MERGE

This is a modification to existing go plugin (provided by Vinod) that aims to create and validate the flow object by checking the 5-tuple information.

Related Issue

Retina ---
#1147 (comment)

CNC
Associated changes with CNC programs that is attaching ebpf programs ---
https://mscodehub.visualstudio.com/NGServerContainerNetworking/_git/cnc/pullrequest/33561

Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.

@vpidatala94 vpidatala94 requested a review from a team as a code owner January 7, 2025 19:22
@vpidatala94
Copy link
Author

vpidatala94 commented Jan 7, 2025

TRACE NOTIFY --
Below snippet indicates how the parser Decode function is able to provide with a flow object that contains packet header information

ts=2025-01-07T10:18:24.262-0800 level=info caller=ebpfwindows/ebpf_windows.go:206 msg=TraceNotify TraceNotify="Ifindex: 4, SrcLabel:0, DstLabel:0, IpV6:false, OrigIP:0.0.0.0"
ts=2025-01-07T10:18:24.263-0800 level=info caller=ebpfwindows/ebpf_windows.go:272 msg="Event converted successfully" flowType=L3_L4
ts=2025-01-07T10:18:24.263-0800 level=info caller=ebpfwindows/ebpf_windows.go:278 msg="5 TUPLE" srcIP=20.1.1.10 dstIP=4.3.2.1 srcP=5200 dstP=5209

@timraymond
Copy link
Member

Please mark this draft if it should not be merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants