nessi
3aa7ae0c65
Add nexafabric-ebpf.go implementing flow collection via Linux raw packet sockets (AF_PACKET) instead of tc/eBPF to enable immediate Proxmox deployment without kernel dependencies, implement packet parsing with VLAN/IP/TCP/UDP/ICMP support and flow aggregation by 5-tuple with vmid/nic/interface/direction metadata extraction from tap/fwbr interface names, add /agents/download/nexafabric-ebpf.go endpoint
1.2 KiB
1.2 KiB
NexaFabric eBPF helper contract
Agent 0.3.0 can call an optional helper binary at /opt/nexafabric-agent/nexafabric-ebpf.
The repository includes a dependency-free Go helper source at nexafabric-ebpf.go.
The first implementation uses Linux raw packet sockets on the selected VM/LXC interfaces and prints the same JSON contract that a tc/eBPF implementation should print. This keeps the helper installable on Proxmox immediately while preserving the agent integration point for a later kernel eBPF loader.
The helper is invoked as:
nexafabric-ebpf --json --limit 1500 --duration 10 --interfaces tap100i0,fwln100i0
It must print JSON to stdout:
{
"flows": [
{
"source_ip": "172.16.0.10",
"destination_ip": "172.16.0.20",
"protocol": "tcp",
"source_port": 443,
"destination_port": 53020,
"packets": 10,
"bytes": 14800,
"vmid": "100",
"interface": "tap100i0",
"direction": "ingress",
"state": "observed"
}
],
"diagnostics": {
"attach_mode": "af_packet_raw_socket",
"interfaces_attached": ["tap100i0"]
}
}
The Python agent merges these flows with firewall-log, packet, and conntrack fallback collectors.