TLDR: Operating system support:
Operating System | userspace | ebpf |
---|---|---|
Windows | yes | no |
macOS | yes | no |
Linux | yes | yes |
Features:
- default: eBPF on Linux and userspace on macOS/Windows
- userspace: userspace on all OSes
The Linux version use eBPF with TC in order to perform the analysis on the TX/RX packets.
- Install bpf-linker:
cargo install bpf-linker
cargo xtask build-ebpf
To perform a release build you can use the --release
flag.
You may also change the target architecture with the --target
flag.
cargo build
export RUST_LOG=info
cargo xtask run
You can check the example. You'll need to download the ebpf program and place it somewhere accessible for the user running the binary.
The macOS and Windows version use pnet's datalink::channel.
- None, just Rust
export RUST_LOG=info
cargo run
Same as for the Linux (they share the same API), but you don't need to specify the eBPF program path.