eBPF HTTP Parser

Installation (self-build)

requirements

LLVM Clang 9
Go runtime

$ make
$ ./parser

https://github.com/cilium/ebpf/blob/0d439865ca157accbc60cc6f3cbeb028fa7901cb/testdata/docker/Dockerfile The Dockerfile of cilium/ebpf will be a reference for building environment.

Supported hooks

HTTP with sys_send() / sys_recv()
HTTP with sys_sendto() / sys_recvfrom()
HTTP with sys_write() / sys_read()

Unsupported hooks (ToDo)