TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

XDP Packet Capture

1 post · Apr 2019

What this trail covers

Cloudflare's XDP capabilities have evolved to include enhanced debugging and visibility tools. The development and open-sourcing of xdpcap, a tcpdump replacement for XDP, allows for efficient packet capture and analysis directly within the eBPF environment. This is facilitated by cbpfc, a compiler that translates classic BPF (cBPF) filters to eBPF, enabling dynamic instrumentation of XDP programs via tail-calls and exposure of matching packets to userspace through perf events. This enhances the ability to debug and troubleshoot network traffic processed at the edge.

All Cloudflare trails
  1. xdpcap: XDP Packet CaptureThis post introduces xdpcap, a new tool for capturing packets processed by XDP programs. It details the architecture of xdpcap, including its use of cbpfc to compile libpcap filter expressions into eBPF, its instrumentation of XDP programs via tail-calls and eBPF maps, and its mechanism for exposing captured packets to userspace using perf events. The post also open-sources both xdpcap and cbpfc.