XDP Packet Capture

4/24/2019

This post introduces xdpcap, a new tool for capturing packets processed by XDP programs, and open-sources the cbpfc compiler. xdpcap allows users to apply tcpdump-like filters to XDP-processed packets, writing them to pcap files or stdout. It achieves this by converting cBPF filters to eBPF using cbpfc and instrumenting XDP programs with tail-call hooks. Matching packets are exposed to userspace via perf events. The post details the architecture of xdpcap, including its filter conversion pipeline, instrumentation strategy using tail-calls and eBPF maps, and packet exposure mechanism via perf event ring buffers.