News for hackers. Stuff that matters.

A comment on How Netflix Accurately Attributes eBPF Flow Logs.

Re:How Netflix Accurately Attributes eBPF Flow Logs by philsnow on Wednesday April 09, 2025 @01:00AM (#43629014)
Is it necessary to rely on ip address attribution? If FlowExporter uses ebpf and tcp tracepoints, could each workloads be placed in its own cgroup and could FlowExporter directly introspect which cgroup (and thus, workload) a given tcp socket event should be attributed to?
[ Parent | on HN ]
Re:How Netflix Accurately Attributes eBPF Flow Logs by nptr on Wednesday April 09, 2025 @01:13PM (#43634617)
That may help identify the local IPs but not the remote IPs.
[ Parent | on HN ]