This repository hosts an eBPF program designed to monitor HTTP traffic on a server, tracking metrics such as request counts, response totals, success rates, and the latency (average, minimum, maximum) associated with requests per IP address.
The core strategy involves integrating a function within the eBPF socket filter to intercept both incoming and outgoing HTTP traffic, subsequently storing this data in a BPF map for further analysis by a userspace application.
To emulate server response times, we've developed a Python web application server. This server randomly generates an integer, pauses for "x" milliseconds (where 0 < x < 10), and then sends this number back to the client. Should this number be divisible by 5, the server issues an HTTP 500 error to mimic a request failure.
An alternative method for HTTP traffic capture involves embedding an eBPF program within system call functions, such as accept4, read, write, and close, regarding socket operations. The code for this approach will be submitted soon.
Below is the guideline to run the program.
Currently, BCC packages for both the Ubuntu Universe, and the iovisor builds are outdated. This is a known and tracked in:
- Universe - Ubuntu Launchpad
- iovisor - BCC GitHub Issues Currently, building from source is currently the only way to get up to date packaged version of bcc.
Run below commands in sudo
sudo add-apt-repository ppa:hadret/bpfcc
sudo apt update
sudo apt-get install bpfcc-tools linux-headers-$(uname -r)
Using docker.sh script
Run docker compose file to get docker bridge name
sudo docker compose up --build
Get bridge name of client network, for example we will monitor interface br-2b4e89c112d8
Run the app server
sudo apt-get -y install python3-pip
pip install flask
python3 app.py
# if you want to run multiple services, use below command in two terminals
flask run --host=0.0.0.0 --port=8080
flask run --host=0.0.0.0 --port=8888
Run the eBPF program (with sudo)
python3 ./http_filter.py -i br-2b4e89c112d8
Open another terminal to run the docker compose again to send HTTP request and you can see the result from eBPF program
Version 2 (monitor by port for multiple services)
The program is developed based on below eBPF examples and Internet resources:
https://github.com/iovisor/bcc
https://github.com/iovisor/bcc/tree/master/examples/networking/http_filter
https://gist.github.com/sunhay/02f235f2942403fada25063242a3aeb1