running mdl on the blog

Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>

Author: msherif1234

content/posts/2025-01-30-ebpf-flows-filtering.md

@@ -15,7 +15,7 @@ leading to CPU overload and excessive memory usage.
 eBPF-based flow filtering solves this challenge by selecting only important flows,
 reducing system strain while maintaining visibility.
 
-## Why Flow Filtering?
+## Why Flow Filtering
 
 The primary goal of flow filtering is resource efficiency.
 Instead of capturing and analyzing every flow, filtering mechanisms allow us to:
@@ -29,9 +29,10 @@ Instead of capturing and analyzing every flow, filtering mechanisms allow us to:
 ✅ Focus on Critical Traffic – Prioritize important flows for security, compliance, and performance monitoring.
 
 ## How Flow Filtering Works in eBPF
+
 eBPF allows filtering flows at the source, avoiding costly user-space processing. This typically involves:
 
-1- Defining Filtering Rules – Specify criteria such as source/destination IP, port, protocol, 
+1- Defining Filtering Rules – Specify criteria such as source/destination IP, port, protocol,
 or application metadata.
 The following table shows all possible filtering options and their default setting:
 
@@ -45,15 +46,15 @@ The following table shows all possible filtering options and their default setti
 | destPorts   | Possible options for destination port settings           |                                                                         |           |
 |             | Single port to match on the flow                         | for example 80 or 443 or 49051                                          |           |
 |             | Range of ports to match on the flow or                   | for example 80-100                                                      |           |
-|             | Two ports to match on                                    | for example 80,100                                                      |           | 
+|             | Two ports to match on                                    | for example 80,100                                                      |           |
 | sourcePorts | Possible options for source port settings                |                                                                         |           |
 |             | Single port to match on the flow                         | for example 80 or 443 or 49051                                          |           |
 |             | Range of ports to match on the flow or                   | for example 80-100                                                      |           |
-|             | Two ports to match on                                    | for example 80,100                                                      |           | 
+|             | Two ports to match on                                    | for example 80,100                                                      |           |
 | ports       | Possible options for destination or source port settings |                                                                         |           |
 |             | Single port to match on the flow                         | for example 80 or 443 or 49051                                          |           |
 |             | Range of ports to match on the flow or                   | for example 80-100                                                      |           |
-|             | Two ports to match on                                    | for example 80,100                                                      |           | 
+|             | Two ports to match on                                    | for example 80,100                                                      |           |
 | icmpType    | ICMP type to match on the flow                           | for example 8 or 13                                                     |           |
 | icmpCode    | ICMP code to match on the flow                           | for example 0 or 1                                                      |           |
 | peerIP      | Peer IP to match on the flow                             | for example 1.1.1.1 or 1::1                                             |           |
@@ -134,7 +135,7 @@ The dual matching approach ensures bidirectional flow tracking, enabling users t
 directions of a given flow.
 
 In cases where no matching rules exist, the default behavior is to reject the flow.
-However, users can customize the handling of unmatched flows by adding a catch-all entry 
+However, users can customize the handling of unmatched flows by adding a catch-all entry
 `(cidr: 0.0.0.0/0)` and specifying a global action to enforce their preferred policy.
 
 ## Key Use Cases
@@ -176,7 +177,7 @@ agent:
           peerCIDR: 10.128.0.0/14
           protocol: ICMP
           icmpType: 8
-``` 
+```
 
 <img src="{page.image('ebpf-flows-filtering/ebpf-svc-and-pods-flows.png')}" alt="eBPF Flows Filtering Kubernetes NorthSouth and EastWest Flows">
 <p style="text-align: center">Figure 2: eBPF Flows Filtering Kubernetes NorthSouth and EastWest Flows</p>
@@ -211,7 +212,7 @@ agent:
 
 Filtering based on TCP flags is an effective method to detect and mitigate TCP SYN flood attacks in a cluster.
 A SYN flood is a Denial-of-Service (DoS) attack where an attacker overwhelms a target system by sending a large
-number of SYN packets without completing the three-way handshake, 
+number of SYN packets without completing the three-way handshake,
 depleting system resources and disrupting legitimate connections.
 
 ```yaml