-
Notifications
You must be signed in to change notification settings - Fork 845
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
关于在pcap模式中tc层skb_data payload数据传输的问题 #450
Labels
question
Further information is requested
Comments
u64 flags = BPF_F_CURRENT_CPU;
flags |= (u64)skb->len << 32;
size_t pkt_size = TC_PACKET_MIN_SIZE;
bpf_perf_event_output(skb, &skb_events, flags, &event, pkt_size); 重点是
Linux Kernel demo : https://elixir.bootlin.com/linux/v5.4/source/samples/bpf/xdp_sample_pkts_kern.c |
还有其他问题吗? |
没有了,谢谢您慷慨的解答'◡' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
您好,我想请问kern/tc.h中skb_data_event_t结构体中只包含了timestamp,pid,comm,len和ifindex
且在capture_packets函数中写入skb_events也限制了写入的大小为pkt_size=TC_PACKET_MIN_SIZE 36字节
而在event_openssl_tc.go中直接读出了payload
想请问这部分payload是如何进行内核态到用户态的传递的
The text was updated successfully, but these errors were encountered: