flow

package
v0.0.0-...-c73473a Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Feb 10, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Index

Constants

View Source
const (
	ReverseDNSNone        = "none"
	ReverseDNSLocalLookup = "local"
	ReverseDNSEBPF        = "ebpf"
)

Variables

This section is empty.

Functions

func Decorate

func Decorate(agentIP net.IP, ifaceNamer InterfaceNamer, input *msg.Queue[[]*ebpf.Record], output *msg.Queue[[]*ebpf.Record]) swarm.RunFunc

Decorate the flows with extra metadata fields that are not directly fetched by eBPF or by any previous pipeline stage (DNS, Kubernetes...): - The interface name (corresponding to the interface index in the flow). - The IP address of the agent host. - If there is no source or destination hostname, the source IP and destination

func DeduperProvider

func DeduperProvider(dd *Deduper, input, output *msg.Queue[[]*ebpf.Record]) swarm.InstanceFunc

DeduperProvider receives flows and filters these belonging to duplicate interfaces. It will forward the flows from the first interface coming to it, until that flow expires in the cache (no activity for it during the expiration time) After passing by the deduper, the ebpf.Record instances loose their IfIndex and Direction fields.

func GeoIPProvider

func GeoIPProvider(cfg *GeoIP, input, output *msg.Queue[[]*ebpf.Record]) swarm.InstanceFunc

func ProtocolFilterProvider

func ProtocolFilterProvider(
	allowed, excluded []string,
	input, output *msg.Queue[[]*ebpf.Record],
) swarm.InstanceFunc

ProtocolFilterProvider allows selecting which protocols are going to be instrumented. It drops any flow not appearing in the "allowed" list. If the Allowed list is empty, it drops any flow appearing in the "excluded" list.

func ReverseDNSProvider

func ReverseDNSProvider(cfg *ReverseDNS, input, output *msg.Queue[[]*ebpf.Record]) swarm.InstanceFunc

Types

type Deduper

type Deduper struct {
	Type               string
	FCTTL              time.Duration
	CacheActiveTimeout time.Duration
}

func (Deduper) Enabled

func (d Deduper) Enabled() bool

type GeoIP

type GeoIP struct {
	IPInfo      IPInfoConfig  `yaml:"ipinfo"`
	MaxMindInfo MaxMindConfig `yaml:"maxmind"`
	CacheLen    int           `yaml:"cache_len" env:"OTEL_EBPF_NETWORK_GEOIP_CACHE_LEN" validate:"gte=0"`
	CacheTTL    time.Duration `yaml:"cache_expiry" env:"OTEL_EBPF_NETWORK_GEOIP_CACHE_TTL" validate:"gte=0"`
}

GeoIP is currently experimental. It is kept disabled by default and will be hidden from the documentation. This means that it does not impact in the overall Beyla performance.

func (GeoIP) Enabled

func (g GeoIP) Enabled() bool

type IPInfoConfig

type IPInfoConfig struct {
	Path string `yaml:"path" env:"OTEL_EBPF_NETWORK_GEOIP_IPINFO_PATH"`
}

type IPLookupFn

type IPLookupFn func(addr net.IP) (ipInfo, error)

type InterfaceNamer

type InterfaceNamer func(ifIndex int) string

type MapTracer

type MapTracer struct {
	// contains filtered or unexported fields
}

MapTracer accesses a mapped source of flows (the eBPF PerCPU HashMap), deserializes it into a flow Record structure, and performs the accumulation of each perCPU-record into a single flow

func NewMapTracer

func NewMapTracer(fetcher mapFetcher, evictionTimeout time.Duration) *MapTracer

func (*MapTracer) Flush

func (m *MapTracer) Flush()

Flush forces reading (and removing) all the flows from the source eBPF map and sending the entries to the next stage in the pipeline

func (*MapTracer) TraceLoop

func (m *MapTracer) TraceLoop(out *msg.Queue[[]*ebpf.Record]) swarm.RunFunc

type MaxMindConfig

type MaxMindConfig struct {
	CountryPath string `yaml:"country_path" env:"OTEL_EBPF_NETWORK_GEOIP_MAXMIND_COUNTRY_PATH"`
	ASNPath     string `yaml:"asn_path" env:"OTEL_EBPF_NETWORK_GEOIP_MAXMIND_ASN_PATH"`
}

type ReverseDNS

type ReverseDNS struct {
	// Type of ReverseDNS. Values are "none" (default), "local" and "ebpf"
	Type string `yaml:"type" env:"OTEL_EBPF_NETWORK_REVERSE_DNS_TYPE" validate:"oneof=none local ebpf"`

	// CacheLen only applies to the "local" and "ebpf" ReverseDNS type. It
	// specifies the max size of the LRU cache that is checked before
	// performing the name lookup. Default: 256
	CacheLen int `yaml:"cache_len" env:"OTEL_EBPF_NETWORK_REVERSE_DNS_CACHE_LEN" validate:"gte=0"`

	// CacheTTL only applies to the "local" and "ebpf" ReverseDNS type. It
	// specifies the time-to-live of a cached IP->hostname entry. After the
	// cached entry becomes older than this time, the IP->hostname entry will be looked
	// up again.
	CacheTTL time.Duration `yaml:"cache_expiry" env:"OTEL_EBPF_NETWORK_REVERSE_DNS_CACHE_TTL" validate:"gte=0"`
}

ReverseDNS is currently experimental. It is kept disabled by default and will be hidden from the documentation. This means that it does not impact in the overall Beyla performance.

func (ReverseDNS) Enabled

func (r ReverseDNS) Enabled() bool

type RingBufTracer

type RingBufTracer struct {
	// contains filtered or unexported fields
}

RingBufTracer receives single-packet flows via ringbuffer (usually, these that couldn't be added in the eBPF kernel space due to the map being full or busy) and submits them to the userspace Aggregator map

func NewRingBufTracer

func NewRingBufTracer(
	reader ringBufReader, flusher mapFlusher, logTimeout time.Duration,
) *RingBufTracer

func (*RingBufTracer) TraceLoop

func (m *RingBufTracer) TraceLoop(out *msg.Queue[[]*ebpf.Record]) swarm.RunFunc

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL