eBPF based TCP observability.

Last update: Jan 3, 2023

Overview

TCPDog is a total solution from exporting TCP statistics from Linux kernel by eBPF very efficiently to store them at your Elasticsearch or InfluxDB database with Geo and ASN informations. It can handle all TCP tracepoints at the same time with different customizeable requests through simple yaml configuration.

Features

TCP socket stats by eBPF TCP tracepoints.
Supports all TCP tracepoints simultaneously.
Customizable TCP fields at kernel space.
Ingest to Elasticsearch, ClickHouse or InfluxDB.
Central collection through gRPC or Kafka.
Supports sampling and filtering at kernel space.
Supports Geo and ASN by Maxmind.

Requirements

Linux kernel versions 4.16 and later
Libbcc

Documentations

Sample Elasticsearch reports

Polygon map and table

Once you installed tcpdog on your servers, you can have the end-user perspective using real performance data which they export by tcpdog. It would be very helpful for SRE and network team to optimize and troubleshooting network and applications.

You can see all the current available metrics here.

Sample JSON Lines output

[RTT,AdvMSS,TotalRetrans,SAddr,DAddr,DPort,LPort,BytesReceived,BytesSent,timestamp]
[172,1460,0,"10.0.2.15","103.17.108.173",80,0,456,73,1612298721]
[55,1460,0,"10.0.2.15","187.141.67.60",80,0,389,74,1612298722]
[140,1460,0,"10.0.2.15","154.118.230.171",443,0,5209,551,1612298723]
[118,1460,0,"10.0.2.15","88.204.157.165",443,0,4445,514,1612298724]
[8,1460,0,"10.0.2.15","47.254.92.5",80,0,760,70,1612298731]
[1,1460,0,"10.0.2.15","184.51.206.209",443,0,4820,577,1612298735]
[238,1460,0,"10.0.2.15","164.100.61.151",80,0,141,71,1612298737]
[171,1460,0,"10.0.2.15","77.238.121.220",80,0,158,74,1612298742]

License

This project is licensed under MIT license. Please read the LICENSE file.

Contribute

Welcomes any kind of contribution, please follow the next steps:

Fork the project on github.com.
Create a new branch.
Commit changes to the new branch.
Send a pull request.

You might also like...

Trace Go program execution with uprobes and eBPF

Weaver PLEASE READ! - I am currently refactoring Weaver to use libbpf instead of bcc which would include various other major improvements. If you're c

263 Dec 28, 2022

eBPF Library for Go

eBPF eBPF is a pure Go library that provides utilities for loading, compiling, and debugging eBPF programs. It has minimal external dependencies and i

3.7k Dec 29, 2022

A distributed Layer 2 Direct Server Return (L2DSR) load balancer for Linux using XDP/eBPF

VC5 A distributed Layer 2 Direct Server Return (L2DSR) load balancer for Linux using XDP/eBPF This is very much a proof of concept at this stage - mos

41 Dec 22, 2022

Edb - An eBPF program debugger

EDB (eBPF debugger) edb is a debugger(like gdb and dlv) for eBPF programs. Norma

153 Dec 31, 2022

An ebpf's tool to watch traffic

watch-dog watch-dog利用ebpf的能力，监听指定网卡的流量来达到旁路检测流量的目的，并使用图数据库neo4j保存节点之间的流量关系。 Get go get github.com/TomatoMr/watch-dog Install make build Usage sudo ./w

0 Feb 5, 2022

SailFirewall - Linux firewall powered by eBPF and XDP

SailFirewall Linux firewall powered by eBPF and XDP Requirements Go 1.16+ Linux

0 May 4, 2022

🚀Gev is a lightweight, fast non-blocking TCP network library based on Reactor mode. Support custom protocols to quickly and easily build high-performance servers.

gev 中文 | English gev is a lightweight, fast non-blocking TCP network library based on Reactor mode. Support custom protocols to quickly and easily bui

1.5k Jan 6, 2023

Encode and Decode Message Length Indicators for TCP/IP socket based protocols

SimpleMLI A Message Length Indicator Encoder/Decoder Message Length Indicators (MLI) are commonly used in communications over raw TCP/IP sockets. This

24 Nov 24, 2022

EasyTCP is a light-weight and less painful TCP server framework written in Go (Golang) based on the standard net package.

EasyTCP is a light-weight TCP framework written in Go (Golang), built with message router. EasyTCP helps you build a TCP server easily fast and less painful.

551 Jan 7, 2023

Comments

Support ClickHouse as backend storage instead of ElasticSearch

Hello @mehrdadrad great tool ;)

could you look to https://clickhouse.tech/docs/en/ and to https://github.com/Altinity/clickhouse-grafana/ ?

and consider feature support ClickHouse as backend storage instead of ElasticSearch? ClickHouse it's a blazing fast columnar database that can be much effective storage for your use-case
enhancement

opened by Slach 3