An eBPF framework designed for deploying eBPF programs in native C.

Steps:

git clone https://github.com/karthickpython/BPFlex.git

cd BPFlex

sudo bash bpftool_installer.sh

cd libbpflex

make

sudo ./tcpstates

View unique active TCP host connections in 'unique_active.txt' and passive connection in unique_passive.txt within the same directory.

tcpstats application created to obtain metrics for the number of unique connections, along with connection details, including the creating process name, process ID, thread ID, 5-tuple information, and connection establishment latency.

Example output:

Time: 16:42:56 Process Name: Chrome_ChildIOT S_IP: 10.15.202.91 SPort: 56922 D_IP: 136.143.180.20 DPort: 443 ThreadID: 2146 PID: 2125 Latency: 291.224

Time: 16:43:10 Process Name: irq/150-iwlwifi S_IP: 10.15.202.91 SPort: 59442 D_IP: 136.143.191.162 DPort: 443 ThreadID: 556 PID: 556 Latency: 254.175

Time: 16:45:41 Process Name: Socket Thread S_IP: 10.15.202.91 SPort: 45360 D_IP: 34.149.100.209 DPort: 443 ThreadID: 22059 PID: 21967 Latency: 3.114