Add eBPF/XDP based packet capture

[jbemmel]

Virtual labs are ideal for capturing packets to analyze what’s going on in the network. However, currently with containerlab it’s a bit hard to figure out which links to monitor, and there is no option to collect from multiple links to trace packets end-2-end

Linux systems have eBPF kernel filters with XDP data path; these are very flexible and could be used to collect - say - vxlan packets with vni 1234, on all links

[hellt]

Last time I looked it takes a lot of effort to install bpf capable kernel. And what's there from clab perspective to make this easy? How do you see clab can help there?

[hellt]

https://blog.cloudflare.com/xdpcap/

[jbemmel]

I came across xdpcap and I was thinking that Containerlab might enable xdp capture on the veth pairs it creates.

It would look something like this:

sudo ip link set dev veth1 xdp object xdp_hook.o

where (I think) XDP hook would look something like this