xdpcap: XDP Packet Capture

This post introduces xdpcap, an open-source tool that acts as a replacement for tcpdump specifically for eXpress Data Path (XDP) programs. It enables packet capture and filtering at the kernel level, addressing the visibility gap created by XDP's early packet processing. The post details the technical implementation, including the use of cBPF to eBPF compilation via cbpfc and eBPF tail-calls for instrumentation, thereby enhancing the ability to analyze and debug network traffic at a very low level.