Sep 9 – 11, 2019
Europe/Lisbon timezone

BPF packet capture helpers, libbpf interfaces

Sep 9, 2019, 10:45 AM
Floriana/room-I (Corinthia Hotel Lisbon)


Corinthia Hotel Lisbon



Alan Maguire (Oracle)


Packet capture is useful from a general debugging standpoint, and is useful in particular in debugging BPF programs that do packet processing. For general debugging, being able to initiate arbitrary packet capture from kprobes and tracepoints is highly valuable (e.g. what do the packets that reach kfree_skb() - representing error codepaths - look like?). Arbitrary packet capture is distinct from the traditional concept of pre-defined hooks, and gives much more flexibility in probing system behaviour. For packet-processing BPF programs, packet capture can be useful for doing things such as debugging checksum errors. The intent of this proposal is to help drive discussion around how to ease use of such features in BPF programs, namely:

  • should additional BPF helper(s) be provided to format packet data suitable for libpcap interpretation?
  • should libbpf provide interfaces for retrieving packet capture data?
  • should interfaces be provided for pushing filters?

Note that while there has been some work in this area already, such as seems like such efforts would be made much simpler if APIs were provided.

I agree to abide by the anti-harassment policy Yes

Primary author

Presentation materials

Diamond Sponsor

Platinum Sponsors

Gold Sponsors

Silver Sponsors

Evening Event Sponsor

Lunch Sponsor

Catchbox Sponsor

T-Shirt Sponsor

Official Carrier

Location Sponsor