Show HN: eBPF-powered L4 package dropper

[boratanrikulu]

https://github.com/boratanrikulu/durdur

[muxamilian]

With L4 you mean the transport layer? I’m a bit confused because in your examples you show layer 3 (IP).

This eBPF-based package dropper using machine learning (decision tree) might be of interest to you: https://github.com/CN-TU/machine-learning-in-ebpf

[boratanrikulu → muxamilian]

I meant Transport Layer packages.

> https://github.com/CN-TU/machine-learning-in-ebpf

Thank you! I'll take a look.

[artemish]

Neat! So this is a tool you can use to implement firewall-ish rules and drop packets from certain IP addresses. It looks like the actual XDP code is written in C, and somehow makes its way into the Go program, is this the way EBPF tools are usually implemented in Go?

[boratanrikulu → artemish]

Thank you! Yes, AFAIK There's no way to code the eBPF part in Go, so I used C without loops. Go part handles loading the eBPF and utilizing the maps. Btw, Rust hcan be used as eBPF code language since It was added to the Kernel.