Show HN: Network Monitor – a GUI to spot anomalous connections on your Linux

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by oneshtein on Saturday November 29, 2025 @04:23PM (#46090910)

eBPF doesn't work on locked down kernels (stock kernels in Secure Boot mode).

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by mroche on Sunday November 30, 2025 @12:00AM (#46093913)

eBPF is restricted when booted in a SB environment, but it's not nonfunctional. The default config puts the kernel into "integrity" mode of Kernel Lockdown, which reduces scope of access and enforces read-only usage.

Whether or not the specific functions needed to replicate this tool are impacted is beyond my knowledge.

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by grigio on Sunday November 30, 2025 @12:18PM (#46098498)

I think this is a great point, eBPF is cool but probably less popular than ss

[ Parent | on HN ]