Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBPF Networking Techniques – Packet Redirection

who.ldelossa.is

Post reply on HN
Print view View original

11–17 of 17 posts

Re: eBPF Networking Techniques – Packet Redirection

#11

Post by jonstickman »

Fantastic write up - keep going (please)!

Agree more practical examples but disagree this is too abstract.

I’m thinking starting at more common scenarios then jumping to container networking. Ie - Flow of a packet on a simple node, a two interface node, then namespaces, and then quirky virtual stuff.

Another example - I’d love to see how iptables actually works. Maybe how to use ebpf to implement iptables things like source/dest NAT, Masquerade, etc.

But yeah I learned a ton here. Thanks

Re: eBPF Networking Techniques – Packet Redirection

#12

Post by ldelossa »

jonstickman wrote: post #11

Fantastic write up - keep going (please)! Agree more practical examples but disagree this is too abstract. I’m thinking starting at more common scenarios then jumping to container networking. Ie - Flow of a packet on a simple node, a two interface node, then namespaces, and then quirky virtual stuff. Another example - I’d love to see how iptables actually works. Maybe how to use ebpf to implement iptables things like…

I do plan on having a "flow of a packet on a simple node". Working on an ingress and egress packet flow posts. These are rather large undertakings tho that require a post of their own IMO. Stay tuned for those :)

Re: eBPF Networking Techniques – Packet Redirection

#13

Post by e12e »

jonstickman wrote: post #11

Fantastic write up - keep going (please)! Agree more practical examples but disagree this is too abstract. I’m thinking starting at more common scenarios then jumping to container networking. Ie - Flow of a packet on a simple node, a two interface node, then namespaces, and then quirky virtual stuff. Another example - I’d love to see how iptables actually works. Maybe how to use ebpf to implement iptables things like…

> I’d love to see how iptables actually works.

If you're actually interested in iptables the old packet filter how-to is great:

https://www.netfilter.org/documentation/HOWTO/packet-filteri...

But iptables is turning into just a legacy interface for nftables in modern Linux. See eg:

https://wiki.debian.org/nftables

https://wiki.nftables.org/wiki-nftables/index.php/Main_Page

Re: eBPF Networking Techniques – Packet Redirection

#14

Post by mordechai9000 »

lfmunoz4 wrote: post #10
ldelossa wrote: post #6

Earlier quoted context omitted.

Thanks for the constructive feedback. The reason laid out in the article was for "jumping over the default linux network stack" to move a packet closer to its destination. I provide that just to hopefully help, ill have to read thru the article again to see how I can improve on making that clearer or defining more practical wording :). And yeah, I understand your comments on all the naming spaghetti. I throw together…

"jumping over the default linux network stack". What are the use cases. What are typical reasons to want to do that, what are benefits and downsides? What are the alternatives.

I really don't know, but the first thing that occurred to me was implementing a "bump in the wire" type firewall. IE, one that sits on the network transparently and can filter and log traffic without affecting layer 2 or 3 headers.

I have no idea if this is an effective and performant approach, but it sounds feasible. Same with implementing switching or routing functionality.

Re: eBPF Networking Techniques – Packet Redirection

#15

Post by yjftsjthsd-h »

ldelossa wrote: post #9
atmosx wrote: post #8

Earlier quoted context omitted.

By skimming through, it is obvious that require familiarity with linux network namespaces and docker/kubernetes networking stack (virtual interfaces and what-not). I don't blame the author though. When you write a technical post, at a certain point you need to assume the readership has some level of context otherwise you'll never complete the post.

Yes, you are right here. It's always difficult to know how far down the tree of topics you should go to provide a end-to-end explanation. I tried to call this out in the start of the article. These are the "hard parts" of technical writing IMO.

I sometimes put a list at the top, like "This article assumes that you have a working familiarity with Linux namespaces (link to 3rd party intro to that), veth interfaces (link to 3rd party intro to that), [...]."

Re: eBPF Networking Techniques – Packet Redirection

#16

Post by RecycledEle »

"In the context of computer networking, BPF stands for Berkeley Packet Filter. It's a technology used for filtering network packets and allows a user-defined program to determine which packets can be sent/received on the network interface. BPF provides a high-performance way to capture and optionally modify packets as they pass through the network stack, making it a powerful tool for network monitoring, packet analysis, and more complex tasks like intrusion detection and network traffic control. It's widely used in various network applications and operating systems for efficient packet processing."

Source: ChatGPT

Re: eBPF Networking Techniques – Packet Redirection

#17

Post by ldelossa »

yjftsjthsd-h wrote: post #15
ldelossa wrote: post #9

Earlier quoted context omitted.

Yes, you are right here. It's always difficult to know how far down the tree of topics you should go to provide a end-to-end explanation. I tried to call this out in the start of the article. These are the "hard parts" of technical writing IMO.

I sometimes put a list at the top, like "This article assumes that you have a working familiarity with Linux namespaces (link to 3rd party intro to that), veth interfaces (link to 3rd party intro to that), [...]."

Good tip
Post reply on HN