1

I am looking for the way in developing kernel packet filter in Linux for filtering packets in high volume network traffic.

I would like to ask whether it is possible or not to use Berkeley Packet Filter (BPF) to implement Bloom filter in Linux kernel? Is there any alternative and better way to implement the kernel filter?

The BPF syntax is rather low-level and difficult to understand, is there any high-level/easier ways to write BPF and good examples/references/tutorials to start with? And, how to debug BPF during development?

3
  • Just find an open source Netsniff-NG Tookit! Does anyone has experience in modifying it or adding logics to it to implement kernel packet filters? And, do you think this is an easier approach when comparing to use BPF to implement kernel packet filter? Feb 5, 2015 at 4:13
  • I find a gentleman asked similar question in this forum almost 3 years ago. The title of the asked question is "Is it possible to discard incoming packets based on (a dynamically changing set of) IP address(es) on Linux from C/C++ code?"! How can I forward my question to him? Thanks a lot. May 5, 2015 at 9:00
  • If you you still need information about this, you should probably search for bcc tools (part of IO Visor project), you'll find that you can now compile BPF programs from C code (with some constraints) and use persistant tables (“maps”). Never heard of a BPF bloom filter, though, but maybe that could be doable with simple hash functions? I don't know.
    – Qeole
    Dec 3, 2016 at 23:35

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.