Hacker News Reader

You can do the same on Linux, just not easily from the command line; ebpf however can do all this and more. Once you have built it you can just create a program that you can use from the command line. There are guides out there to show you how.[0]

[0] https://www.datadoghq.com/blog/ebpf-guide/

I've been meaning to try out eBPF. I read a tutorial on writing a simple perf application in Rust, but I kind of lack the intuition to know what it's good for.

Do you know a good overview of what can be done with eBPF?

Think of it like small, isolated programs that run in a VM that is managed by the kernel and has access to many kernel APIs and datastructures without needing to do syscalls.

I believe they can both monitor and manipulate data as it flows through the OS primatives (sockets, file descriptors, etc.).

nftables supports matching by cgroups, which arguably is a better idea than process IDs.

https://wiki.nftables.org/wiki-nftables/index.php/Matching_p...

Do you have a link to Sniffer?