Linux: kernel: eBPF & BCC & bpftrace & socket filter

reference

https://docs.cilium.io/en/latest/bpf/#bpf-guide
http://www.brendangregg.com/
https://lwn.net/Articles/740157/
https://github.com/iovisor/bcc
https://cilium.isovalent.com/hubfs/Learning-eBPF%20-%20Full%20book.pdf

需要注意的问题

bcc-tools的使用需要和内核版本对应上。比如tcpdrop这个脚本命令里，就有对tcp_drop内核函数的依赖。而在新版本的内核里这个函数已经被tcp_drop_reason所代替，就会出现一些问题。

if b.get_kprobe_functions(b"tcp_drop")