Skip to content

Commit 988a606

Browse files
msherif1234msherif1234
committed
eBPF flows filtering support
Signed-off-by: Mohamed Mahmoud <[email protected]>
1 parent 456e8e8 commit 988a606

File tree

6 files changed

+228
-0
lines changed

6 files changed

+228
-0
lines changed

‎content/posts/2025-01-30-ebpf-flows-filtering.md‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
---
2+
layout: :theme/post
3+
title: "Enhancing NetObserv By Introducing Multi Rules Flow filtering capability in eBPF"
4+
description: NetObserv eBPF Flows Filtering
5+
tags: eBPF,Monitoring,Troubleshooting
6+
authors: [msherif1234]
7+
---
8+
9+
# Flow Filtering in eBPF: Optimizing Resource Usage by Selecting Critical Flows
10+
11+
## Introduction
12+
13+
In high-traffic environments, processing every network flow can be resource-intensive,
14+
leading to CPU overload and excessive memory usage.
15+
eBPF-based flow filtering solves this challenge by selecting only important flows,
16+
reducing system strain while maintaining visibility.
17+
18+
## Why Flow Filtering?
19+
20+
The primary goal of flow filtering is resource efficiency.
21+
Instead of capturing and analyzing every flow, filtering mechanisms allow us to:
22+
23+
✅ Reduce CPU & Memory Overhead – Process only relevant traffic, avoiding unnecessary computation.
24+
25+
✅ Optimize Storage Usage – Store only meaningful flow records, reducing disk and database load.
26+
27+
✅ Enhance Performance – Minimize packet processing latency and improve system responsiveness.
28+
29+
✅ Focus on Critical Traffic – Prioritize important flows for security, compliance, and performance monitoring.
30+
31+
## How Flow Filtering Works in eBPF
32+
eBPF allows filtering flows at the source, avoiding costly user-space processing. This typically involves:
33+
34+
1️⃣ Defining Filtering Rules – Specify criteria such as source/destination IP, port, protocol,
35+
or application metadata, The following table shows all possible filtering options and their default setting
36+
37+
| Option | Description | Possible values | Default |
38+
|-------------|----------------------------------------------------------|-------------------------------------------------------------------------|-----------|
39+
| enable | Enable flow filter | true, false | false |
40+
| action | Action to apply on the flow | Accept, Reject | Accept |
41+
| cidr | CIDR to match on the flow | for example 1.1.1.0/24 or 1::100/64 or 0.0.0.0/0 | 0.0.0.0/0 |
42+
| protocol | Protocol to match on the flow | TCP, UDP, SCTP, ICMP, ICMPv6 | |
43+
| direction | Direction to match on the flow | Ingress, Egress | |
44+
| destPorts | Possible options for destination port settings | | |
45+
| | Single port to match on the flow | for example 80 or 443 or 49051 | |
46+
| | Range of ports to match on the flow or | for example 80-100 | |
47+
| | Two ports to match on | for example 80,100 | |
48+
| sourcePorts | Possible options for source port settings | | |
49+
| | Single port to match on the flow | for example 80 or 443 or 49051 | |
50+
| | Range of ports to match on the flow or | for example 80-100 | |
51+
| | Two ports to match on | for example 80,100 | |
52+
| ports | Possible options for destination or source port settings | | |
53+
| | Single port to match on the flow | for example 80 or 443 or 49051 | |
54+
| | Range of ports to match on the flow or | for example 80-100 | |
55+
| | Two ports to match on | for example 80,100 | |
56+
| icmpType | ICMP type to match on the flow | for example 8 or 13 | |
57+
| icmpCode | ICMP code to match on the flow | for example 0 or 1 | |
58+
| peerIP | Peer IP to match on the flow | for example 1.1.1.1 or 1::1 | |
59+
| peerCIDR | Peer IPCIDR to match on the flow | for example 1.1.1.1/24 or 1::1/48 | |
60+
| pktDrops | filter flows with packets drop | true, false | |
61+
| sampling | sampling rate to use for filtered flows | for example 10 or 20 (any value >= 1) | |
62+
| tcpFlags | TCP flags to filter flows by | "SYN";"SYN-ACK";"ACK";"FIN";"RST";"URG";"ECE";"CWR";"FIN-ACK";"RST-ACK" | |
63+
64+
65+
Note:
66+
67+
- You can't use ports and either sourcePorts or destPorts in the same rule.
68+
69+
The Following configuration example shows some of the possible filtering options with multi rules filters
70+
71+
```yaml
72+
agent:
73+
type: eBPF
74+
ebpf:
75+
flowFilter:
76+
enable: true
77+
rules:
78+
- action: Accept
79+
cidr: 10.128.0.0/24
80+
peerCIDR: 10.129.0.0/24
81+
ports: 443,6443
82+
protocol: TCP
83+
sampling: 10
84+
- action: Accept
85+
cidr: 10.129.0.1/24
86+
ports: 53
87+
protocol: UDP
88+
sampling: 20
89+
- action: Reject
90+
tcpFlags: "SYN"
91+
cidr: 10.130.0.0/24
92+
protocol: TCP
93+
sourcePorts: 80-100
94+
- action: Accept
95+
cidr: 172.30.0.0/16
96+
protocol: SCTP
97+
pktDrops: true
98+
- action: Reject
99+
cidr: 8.8.8.8/32
100+
protocol: ICMP
101+
icmpType: 8 // ICMP Echo request packet
102+
```
103+
2️⃣ Packet Inspection – Extract relevant packet attributes within an eBPF program.
104+
105+
3️⃣ Early Flow Filtering –
106+
Skip or Allow packets based on predefined conditions before doing further ebpf packets processing.
107+
The Following Diagram shows how eBPF filtering is done
108+
109+
<img src="{page.image('ebpf-flows-filtering/ebpf-flows-filtering.png')}" alt="eBPF Flows Filtering Processing">
110+
111+
Note:
112+
- The maximum number of eBPF flow filter rules is limited to 16 to ensure conservative memory
113+
usage when this feature is enabled.
114+
115+
- rules with duplicate CIDRs are rejected via validation webhook.
116+
117+
- Both IPv4 and IPv6 formats are supported.
118+
119+
- In case users wanted to match on any CIDR, default Null CIDR `0.0.0.0/0` can be used.
120+
121+
## Key Use Cases
122+
123+
🚀 Reducing Observability Overhead – Avoid logging irrelevant flows in high-traffic Kubernetes clusters.
124+
125+
🔐 Security Filtering – Focus on anomalous or suspicious traffic while ignoring normal flows.
126+
127+
🌐 Network Performance Monitoring – Capture only high-latency or dropped-packet flows for troubleshooting.
128+
129+
### Filter EastWest and NorthSouth flows
130+
131+
Let's allow serviceIP 172.30.100.64:80 with sample 10
132+
and allow pods traffic between subnet 10.128.0.0/16 and 10.129.0.0/16 with sampling 20 and reject everything else
133+
134+
```yaml
135+
agent:
136+
type: eBPF
137+
ebpf:
138+
flowFilter:
139+
enable: true
140+
rules:
141+
- action: Accept
142+
cidr: 172.30.0.0/16
143+
sampling: 10
144+
- action: Accept
145+
cidr: 10.128.0.0/16
146+
peerCIDR: 10.129.0.0/16
147+
sampling: 20
148+
- action: Reject
149+
cidr: 0.0.0.0/0
150+
```
151+
152+
<img src="{page.image('ebpf-flows-filtering/ebpf-svc-and-pods-flows.png')}" alt="eBPF Flows Filtering Kubernetes NorthSouth and EastWest Flows">
153+
154+
### Filter flows with packet drops
155+
156+
let's filter any kubernetes service flows with a packet drop and reject everything else,
157+
please note for this use case to work need to enable `PacketDrop` feature which requires `privileged` flag
158+
to be set to `true` as shows in the following sample configuration
159+
160+
```yaml
161+
agent:
162+
type: eBPF
163+
ebpf:
164+
privileged: true
165+
features:
166+
- PacketDrop
167+
flowFilter:
168+
enable: true
169+
rules:
170+
- action: Accept
171+
cidr: 172.30.0.0/16
172+
pktDrops: true
173+
- action: Reject
174+
cidr: 0.0.0.0/0
175+
```
176+
177+
<img src="{page.image('ebpf-flows-filtering/ebpf-filter-svc-pkt-drops.png')}" alt="eBPF Flows Filtering Kubernetes Services with Packet Drop">
178+
179+
### Filter TCP flows with TCP Flags detect TCP SYN Flood attack
180+
181+
Using TCP Flags filtering can help detect when your cluster is under TCP Syn Flood attack
182+
183+
```yaml
184+
agent:
185+
type: eBPF
186+
ebpf:
187+
flowFilter:
188+
enable: true
189+
rules:
190+
- action: Accept
191+
cidr: 0.0.0.0/0
192+
protocol: TCP
193+
tcpFlags: "SYN"
194+
sampling: 1
195+
```
196+
197+
<img src="{page.image('ebpf-flows-filtering/ebpf-filter-with-tcpflags.png')}" alt="eBPF Flows Filtering TCP flows using TCP flags">
198+
199+
### Filter DNS query over ports 53 and 5353 for both TCP and UDP
200+
201+
```yaml
202+
agent:
203+
type: eBPF
204+
ebpf:
205+
features:
206+
- DNSTracking
207+
flowFilter:
208+
enable: true
209+
rules:
210+
- action: Accept
211+
cidr: 0.0.0.0/0
212+
sourcePorts: 53,5353
213+
sampling: 1
214+
```
215+
216+
<img src="{page.image('ebpf-flows-filtering/ebpf-filter-DNS-flows.png')}" alt="eBPF Flows Filtering DNS flows">
217+
218+
## Conclusion
219+
220+
By filtering flows at the kernel level with eBPF, we maximize efficiency,
221+
ensuring only the most relevant data is processed and stored.
222+
This approach is critical for scalability, cost reduction, and real-time network insights.
223+
224+
## Feedback
225+
226+
We hope you liked this article!
227+
Netobserv is an OpenSource project [available on github](https://github.com/netobserv).
228+
Feel free to share your [ideas](https://github.com/netobserv/network-observability-operator/discussions/categories/ideas), [use cases](https://github.com/netobserv/network-observability-operator/discussions/categories/show-and-tell) or [ask the community for help](https://github.com/netobserv/network-observability-operator/discussions/categories/q-a).

‎static/assets/images/ebpf-flows-filtering/ebpf-filter-DNS-flows.png‎

215 KB
Loading

‎static/assets/images/ebpf-flows-filtering/ebpf-filter-svc-pkt-drops.png‎

121 KB
Loading

‎static/assets/images/ebpf-flows-filtering/ebpf-filter-with-tcpflags.png‎

222 KB
Loading

‎static/assets/images/ebpf-flows-filtering/ebpf-flows-filtering.png‎

97.9 KB
Loading

‎static/assets/images/ebpf-flows-filtering/ebpf-svc-and-pods-flows.png‎

208 KB
Loading

0 commit comments

Comments
 (0)