Accurate, low-overhead per process bandwidth monitoring in 40 lines of bpftrace

Posted by silviot on Thursday April 15, 2021 @06:49AM
from the gcardone.net dept.

https://www.gcardone.net/2020-07-31-per-process-bandwidth-monitoring-on-Linux-with-bpftrace/

( 7 comments | 76 points | on HN )

Re:Accurate, low-overhead per process bandwidth monitoring i... by thomashabets2 on Thursday April 15, 2021 @10:03AM (#26820627)

Nice. I have done similar for measuring per-device bandwidth of USB devices with bpftrace:

https://blog.habets.se/2020/08/Measuring-USB-with-bpftrace.h...

[ Parent | on HN ]

Re:Accurate, low-overhead per process bandwidth monitoring i... by londons_explore on Friday April 16, 2021 @01:01AM (#26829681)

Once tools using bpftrace become common, refactoring the Linux kernel will never happen again.

It would break too many tools that depend on exact internal function names existing.

[ Parent | on HN ]

Re:Accurate, low-overhead per process bandwidth monitoring i... by SubjectToChange on Friday April 16, 2021 @12:17PM (#26835800)

bpftrace is for ad-hoc dynamic tracing, other programs shouldn't call directly out to it.

Anyway, other dynamic tracing frameworks like SystemTap or LTTng have been using tracepoints, kprobes, and kretprobes for over fifteen years now. Refactoring kernel code isn't going to suddenly become impossible just because of tools new tools like bpftrace.

[ Parent | on HN ]

Re:Accurate, low-overhead per process bandwidth monitoring i... by tkinom on Thursday April 15, 2021 @11:28AM (#26821629)

After I see app's bandwidth usage, if I want to block that app's traffic, what's the best way to do that?

[ Parent | on HN ]

Re:Accurate, low-overhead per process bandwidth monitoring i... by effie on Thursday April 15, 2021 @11:55AM (#26822043)

You have to run the app with dedicated UID, then

    iptables -I OUTPUT -m owner --uid-owner <UID> -j DROP
    ip6tables -I OUTPUT -m owner --uid-owner <UID> -j DROP

[ Parent | on HN ]

Re:Accurate, low-overhead per process bandwidth monitoring i... by mircea on Thursday April 15, 2021 @08:29PM (#26827877)

Run the app in a separate netns and then you can create iptables/netfilter rules that match on that netns.

[ Parent | on HN ]

Re:Accurate, low-overhead per process bandwidth monitoring i... by effie on Thursday April 15, 2021 @12:03PM (#26822187)

Not working on 4.19.

    # bpftrace socktraf.bt
    12.12-160: syntax error, unexpected struct

[ Parent | on HN ]