Accurate, low-overhead per process bandwidth monitoring in 40 lines of bpftrace | Hacker News Reader

Accurate, low-overhead per process bandwidth monitoring in 40 lines of bpftrace

gcardone.net

76 pointssilviot7 comments

Open articleView on HN

Nice. I have done similar for measuring per-device bandwidth of USB devices with bpftrace:

https://blog.habets.se/2020/08/Measuring-USB-with-bpftrace.h...

Once tools using bpftrace become common, refactoring the Linux kernel will never happen again.

It would break too many tools that depend on exact internal function names existing.

bpftrace is for ad-hoc dynamic tracing, other programs shouldn't call directly out to it.

Anyway, other dynamic tracing frameworks like SystemTap or LTTng have been using tracepoints, kprobes, and kretprobes for over fifteen years now. Refactoring kernel code isn't going to suddenly become impossible just because of tools new tools like bpftrace.

After I see app's bandwidth usage, if I want to block that app's traffic, what's the best way to do that?

You have to run the app with dedicated UID, then

    iptables -I OUTPUT -m owner --uid-owner <UID> -j DROP
    ip6tables -I OUTPUT -m owner --uid-owner <UID> -j DROP

Run the app in a separate netns and then you can create iptables/netfilter rules that match on that netns.

Not working on 4.19.

    # bpftrace socktraf.bt
    12.12-160: syntax error, unexpected struct

Reply on news.ycombinator.com