TCP Tracepoints have arrived in Linux

I'm sure you found these too, but your comment made me want to refresh my memory:

For older kernels, there is a ftrace way for tracing retransmits: http://www.brendangregg.com/blog/2014-09-06/linux-ftrace-tcp...

The oldest are SNMP style counters used by "netstat -s" / "sar -n ETCP" for all retransmits on the system, if you don't need per flow stats.

Ten there's an application level getsockopt TCP_INFO, detailed at: https://linuxgazette.net/136/pfeiffer.html

tcpdump shows on-the-wire packet details only, and works by instrumenting all send/receive events. These tracepoints can expose a lot more information: kernel state (including congestion control metrics), process IDs, application stacks, etc, and do so with much lower overhead by instrumenting lower-frequency events only. This makes it much more suitable for production use. We'll be able to collect TCP session information 24x7 with negligible overhead, whereas tcpdump/libpcap would be too expensive in our environment (Netflix).

I haven't used Little Snitch, but if it's a firewall then yes, this work is related to the eBPF work in Linux, which has been used for custom firewalls. There's a lot of work in this space, so I don't know where best to start. One example is cilium: https://github.com/cilium/cilium

I think the cgroup BPF filters align more with what Little Snitch can do as opposed to the TCP tracepoints. In modern versions of systemd, you can restrict a given network application to only having access to specific IPs via this mechanism.

There is https://github.com/evilsocket/opensnitch

Haven't used it though.

No. I always make sure I put Linux and BSD logos on my slidedecks when introducing Netflix. Linux on the cloud, BSD on the CDN. And also, the TCP tracepoint kernel commits was really done by multiple other companies. :)