Module bpf

Modules§

attach 🔒: Attach a cBPF program to a socket via SO_ATTACH_FILTER. The kernel copies the program during the call, so prog need only remain valid for the duration of this function.
attach_dns_filter 🔒: Attach a filter to a raw UDP socket so the kernel only delivers DNS replies destined to sport whose DNS transaction ID carries our 6-bit identifier, dropping all other UDP traffic (e.g. the host’s own DNS resolution).
attach_icmp_filter 🔒: Attach a filter to a raw ICMP socket so the kernel only delivers ICMP echo replies whose identifier matches icmp_id, dropping all other ICMP traffic.
attach_tcp_filter 🔒: Attach a filter to a raw TCP socket so the kernel only delivers TCP segments with the RST flag set whose destination port matches sport (the worker’s source port), dropping all other TCP traffic — which on a raw TCP socket includes a copy of every TCP segment on the host (SSH, the gRPC control connection to the orchestrator, etc.).
attach_traceroute_filter 🔒: Attach a filter to a raw ICMP socket for traceroute measurements: deliver ICMP Time Exceeded (intermediate hops), Destination Unreachable (destination reached for UDP traceroute), and Echo Reply (destination reached for ICMP traceroute), dropping all other ICMP traffic.
sf 🔒