github.com/cilium/ebpf@v0.15.1-0.20240517100537-8079b37aa138/examples/README.md (about)

     1  # eBPF Examples
     2  
     3  * Kprobe - Attach a program to the entry or exit of an arbitrary kernel symbol (function).
     4    * [kprobe](kprobe/) - Kprobe using bpf2go.
     5    * [kprobepin](kprobepin/) - Reuse a pinned map for the kprobe example. It assumes the BPF FS is mounted at `/sys/fs/bpf`.
     6    * [kprobe_percpu](kprobe_percpu/) - Use a `BPF_MAP_TYPE_PERCPU_ARRAY` map.
     7    * [ringbuffer](ringbuffer/) - Use a `BPF_MAP_TYPE_RINGBUF` map.
     8  * Uprobe - Attach a program to the entry or exit of an arbitrary userspace binary symbol (function).
     9    * [uretprobe](uretprobe/) - Uretprobe using bpf2go.
    10  * Tracepoint - Attach a program to predetermined kernel tracepoints.
    11    * [tracepoint_in_c](tracepoint_in_c/) - Tracepoint using bpf2go.
    12    * [tracepoint_in_go](tracepoint_in_go/) - Tracepoint using the `ebpf.NewProgram` API and Go eBPF assembler.
    13  * Cgroup - Attach a program to control groups (cgroups).
    14    * [cgroup_skb](cgroup_skb/) - Count packets egressing the current cgroup.
    15  * Fentry - Attach a program to the entrypoint of a kernel function.
    16    Like kprobes, but with better performance and usability, for kernels 5.5 and later.
    17    * [tcp_connect](fentry/) - Trace outgoing IPv4 TCP connections.
    18    * [tcp_close](tcprtt/) - Log RTT of IPv4 TCP connections using eBPF CO-RE helpers.
    19  * XDP - Attach a program to a network interface to process incoming packets.
    20    * [xdp](xdp/) - Print packet counts by IPv4 source address.
    21  * Add your use case(s) here!
    22  
    23  ## How to run
    24  
    25  ```bash
    26  cd ebpf/examples/
    27  go run -exec sudo [./kprobe, ./uretprobe, ./ringbuffer, ...]
    28  ```
    29  
    30  ## How to recompile
    31  
    32  The examples are built via `go generate` invoked by the Makefile in the project root.
    33  
    34  ```
    35  make -C ../
    36  ```