Overview / Usage

libebpfflow is a traffic visibility library based on eBPF able to compute network flows. It can be used to:

• enable network visibility
• create a packet-less network probe
• inspect host and container communications for different container runtimes

Methodology / Approach

The library is based on eBPF to track system events and thus analyse network traffic without having to dissect network packets. This has the great advantage to be able to deliver application monitoring with limited resources and lightweight system load that is a mandatory features on complex environments.

Technologies Used

eBPF

Repository

https://github.com/ntop/libebpfflow