Tag: tcpdump

看到 CloudFlare 的「BPF - the forgotten bytecode」在文章裡提到 BPF (Berkeley Packet Filter)，發現從大學畢業後就沒再看過... (然後也沒什麼印象了)

tcpdump 可以把 expression 轉成 BPF bytecode，再丟進 kernel 執行，拿 CloudFlare 文章裡的例子在自己電腦上跑：

gslin@GSLIN-DESKTOP [~] [07:27/W4] sudo tcpdump -p -ni eth1 -d "ip and udp"
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 5
(002) ldb      [23]
(003) jeq      #0x11            jt 4    jf 5
(004) ret      #65535
(005) ret      #0

而對於複雜的過濾邏輯而需要拼效能時，可能會需要手動寫 bytecode (像是優先先判斷某些比較容易過濾的欄位，藉以降低判斷的量)，可以透過 SOCK_RAW 與 SO_ATTACH_FILTER 直接寫 bytecode 給 kernel 執行。

雖然文章內沒有明講，不過看起來 CloudFlare 有這樣做，尤其後面又有提到：

These kind of rules are very useful, they allow us to pinpoint the malicious traffic and drop it early. Just in the last couple of weeks we dropped 870,213,889,941 packets with few BPF rules. Recently during a flood we saw 41 billion packets dropped throughout a night due to a single well placed rule.

記起來以後說不定用的到...