Skip to content

Support tcpdump pcap filters for stream identification#4

Open
SPYFF wants to merge 4 commits into
mainfrom
pcap-filter
Open

Support tcpdump pcap filters for stream identification#4
SPYFF wants to merge 4 commits into
mainfrom
pcap-filter

Conversation

@SPYFF

@SPYFF SPYFF commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Extend IPv6 flowlabel based stream identification with generic, tcpdump filter expression support.

  • Use libpcap to compile string to cBPF bytecode
  • Pass the compiled cBPF filter to kernel with a BPF map
  • Implement a cBPF interpreter in eBPF
  • The interpreter execute the cBPF filter on packet received in XDP

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant