TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Using BPF to Transform SSH Sessions into Structured Events

206 点作者 twakefield大约 5 年前

5 条评论

russjones大约 5 年前
Author of the post here, happy to answer any questions.
评论 #22437411 未加载
评论 #22439808 未加载
评论 #22438425 未加载
评论 #22438198 未加载
评论 #22441621 未加载
评论 #22440471 未加载
kalium_xyz大约 5 年前
BPF is extremely awesome. I cant wait to see more projects using it.
justlexi93大约 5 年前
It's just that Linux's eBPF system has been extended far, far beyond packet filtering.
cptwunderlich大约 5 年前
Since the author, russjones, seems to be here, I&#x27;d like to ask a question regarding writing the actual BPF programs. I&#x27;ve been writing a term paper about BPF verification, the in-kernel verifier and research like PREVAIL [1], so I&#x27;m curious.<p>Is writing valid BPF programs really that &quot;hard&quot;? E.g., does one often have to rewrite programs bc. the verifier wouldn&#x27;t accept them? Do you see a need to extend BPF with more capabilities? (bounded loops have been added in Kernel 5.3, but maybe something else)<p>Thank you.<p>[1] <a href="https:&#x2F;&#x2F;vbpf.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;vbpf.github.io&#x2F;</a>
saber6大约 5 年前
I never thought about needing streams of information like this, but now that I am, this is a great way to provide general trace-tooling for containers and other things!<p>Very interesting post. Thanks for sharing.
评论 #22440299 未加载