Hacker News Reader

Comment by bhickey | Hacker News Reader

Maybe I'm missing the point of bpfgen. What additional functionality does it provide over tcpdump?

    tcpdump -i eth0 -d dst 127.0.0.1
    (000) ldh      [12]
    (001) jeq      #0x800           jt 2    jf 4
    (002) ld       [30]
    (003) jeq      #0x7f000001      jt 8    jf 9
    (004) jeq      #0x806           jt 6    jf 5
    (005) jeq      #0x8035          jt 6    jf 9
    (006) ld       [38]
    (007) jeq      #0x7f000001      jt 8    jf 9
    (008) ret      #65535
    (009) ret      #0

View on HN

The pcap filter language isn't very powerful. Once you get outside of the primitives it supplies, even very simple things become hard or impossible. The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on.

(I once wanted a pcap filter that matched SYN packets with a wscale option set; it ended up being a 8kB long filter due to needing to handle different ordering of variable sized TCP options. It would have been pretty trivial to do in raw BPF).

    The examples here seem to be for doing pattern matching (with wildcards) on portions of DNS query packets. That's definitely in the range of things you can't coerce the pcap filter language to do an even adequate job on.

Ah-ha, thanks! I've written quite a bit of BPF but haven't dug too deeply into pcap filters. Based on the examples it looked redundant with the pcap language.

tcpdump is just for filtering and capture. BPF allows dropping packets based on complex matching rules.

I would say that BPF is closer to iptables rules then tcpdump.

Quote from the README: .... The aim of this tool is to help creating BPF rules that will match (and drop) malicious traffic.

I haven't used BPF before, because I haven't had a need to yet. But I have been very interested in BPF for some time now. I hope more tools are made to make it easier to use BPF.

BPF is actually a tiny virtual machine (!) language designed to run securely in a kernel.

This is very different from iptables, where everything has to be expressed as a rule ("policy") with a set of fixed parameters that match a packet. iptables has a way to jump around in the rule set ("chains"), but it's not quite Turing-complete.

In Linux, BPF has been generalized (as eBPF, "extended BPF") to work not just with networking, but the kernel as a whole, though I'm not sure how extensive the set of available tracepoints is at the moment.

Normal BPF already worked with seccomp as well, which is outside of networking. But yes, eBPF is a major advancement, i.e. you can program eBPF code in a C language subset and compile it with LLVM. There's quite some possibilities already used in tracing and networking (here: tc classifier and actions and socket filters).

Reply on news.ycombinator.com