HN Explorer

7 comments

[ 0.22 ms ] story [ 29.6 ms ] thread
tkinom
After I see app's bandwidth usage, if I want to block that app's traffic, what's the best way to do that?
effie
You have to run the app with dedicated UID, then

    iptables -I OUTPUT -m owner --uid-owner <UID> -j DROP
    ip6tables -I OUTPUT -m owner --uid-owner <UID> -j DROP
mircea
Run the app in a separate netns and then you can create iptables/netfilter rules that match on that netns.
effie
Not working on 4.19.

    # bpftrace socktraf.bt
    12.12-160: syntax error, unexpected struct
londons_explore
Once tools using bpftrace become common, refactoring the Linux kernel will never happen again.

It would break too many tools that depend on exact internal function names existing.

SubjectToChange
bpftrace is for ad-hoc dynamic tracing, other programs shouldn't call directly out to it.

Anyway, other dynamic tracing frameworks like SystemTap or LTTng have been using tracepoints, kprobes, and kretprobes for over fifteen years now. Refactoring kernel code isn't going to suddenly become impossible just because of tools new tools like bpftrace.