Cloudflare has released xdpcap, a traffic analyzer based on the XDP subsystem.

Cloudflare introduced open project xdpcap, within which a tcpdump-like network packet analyzer is developed based on the XDP (eXpress Data Path). The project code is written in Go and is distributed is licensed under BSD. The project also has been prepared provides a library for binding eBPF traffic handlers from Go applications.

The xdpcap utility is compatible with tcpdump/libpcap filtering expressions and allows processing significantly larger volumes of traffic on the same hardware. Xdpcap can also be used for debugging in scenarios where regular tcpdump is unsuitable, such as when filtering systems, DoS protection, and load balancing that utilize the Linux kernel XDP subsystem are employed, which processes packets before they are handled by the Linux kernel network stack (tcpdump does not see packets dropped by the XDP handler).

High performance is achieved through the use of eBPF and XDP subsystems. eBPF is a bytecode interpreter built into the Linux kernel that allows the creation of high-performance handlers for incoming/outgoing packets, making decisions on their redirection or dropping. Using a JIT compiler, eBPF bytecode is compiled on-the-fly into machine instructions and executed with native code performance. The XDP (eXpress Data Path) subsystem complements eBPF with the ability to run BPF programs at the network driver level, supporting direct access to DMA packet buffers and operating before the network stack allocates the skbuff buffer.

Like tcpdump, the xdpcap utility first translates high-level traffic filtering rules into the classic BPF (cBPF) representation using the standard libpcap library, after which it converts them into eBPF subroutine form using the cbpfc, which leverages LLVM/Clang. The output traffic information is saved in the standard pcap format, allowing the traffic dump prepared in xdpcap to be used later for analysis in tcpdump and other existing traffic analyzers. For example, to capture DNS traffic information instead of the command 'tcpdump ip and udp port 53', one can run 'xdpcap /path/to/hook capture.pcap 'ip and udp port 53'', after which the capture.pcap file can be used, for example, with the command 'tcpdump -r' or in Wireshark.

Source: opennet.ru