Simon Sundberg 70f255cbf8 pping: Ignore SYN packets by default
Make ePPing ignore TCP SYN packets by default, so that the
initial handshake phase of the connection is ignored. Add an
option (--include-syn/-s) to explicitly include SYN packets.

The main reason it can be a good idea to avoid SYN-packets is to avoid
being affected by SYN-flood attacks. When ePPing also includes
SYN-packets it becomes quite vulnerable to SYN-flood attacks, which
will quickly fill up its flow_state table, blocking actual useful
flows from being tracked. As ePPing will consider the connection
opened as soon as it sees the SYN-ACK (it will not wait for final
ACK), flow-state created from SYN-flood attacks will also stay around
in the flow-state table for a long time (5 minutes currently) as no
RST/FIN will be sent that can be used to close it.

The drawback from ignoring SYN-packets is that no RTTs will be
collected during the handshake phase, and all connections will be
considered opened due to "first observed packet".

A more refined approach could be to properly track the full TCP
handshake (SYN + SYN-ACK + ACK) instead of the more generic "open once
we see reply in reverse direction" used now. However, this adds a fair
bit of additional protocol-specific logic. Furthermore, to track the
full handshake we will still need to store some flow-state before the
handshake is completed, and thus such a solution would still be
vulnerable to SYN-flood attacks (although the incomplete flow states
could potentially be cleaned up faster).

Signed-off-by: Simon Sundberg <simon.sundberg@kau.se>
2022-11-04 13:47:08 +01:00
2021-06-21 22:51:57 +02:00
2022-03-06 21:54:01 +08:00
2022-04-20 13:12:45 +02:00
2021-11-06 12:33:09 +00:00

Practical BPF examples

This git repository contains a diverse set of practical BPF examples that solve (or demonstrate) a specific use-case using BPF.

It is meant to ease doing rapid prototyping and development, writing C-code BPF programs using libbpf. The goal is to make it easier for developers to get started coding.

Many developers struggle to get a working BPF build environment. The repo enviroment makes it easy to build/compile BPF programs by doing the necessary libbpf setup transparently and detect missing compile dependencies (via the configure script). It is a declared goal to make BPF programming more consumable by detecting and reporting issues (when possible).

Description
No description provided
Readme 25 MiB
Languages
C 93.6%
Shell 4.7%
Makefile 1.6%