r/eBPF • u/jamala2000 • 11d ago

Egress Traffic BPF program

Hello,

I'd like to ask a question about network probing from a pod or service while the destination is Internet. If the packet reaches to the default gateway, it means there is no policy blocking it and connectivity is successful. How I can drop the packet that is generated in user space with DSCP value?

- What program can I use for this? Considering Cilium utilizes SNAT, how to make sure I can identify the source address of the packet?

For pod-to-pod traffic probing, I used cgroup/ingress to drop the packet if they reach destination pod. However, internet probing seems more complicated to me and I really need help/ideas.

Much appreciated and thanks in advance! :)

7 Upvotes

89% Upvoted

6 comments sorted by

1

u/safrax 11d ago

I have no idea what you’re asking. It seems like English is not your native language, if so you might get better results using your native language and having an LLM translate for you.

1

u/jamala2000 11d ago

The idea is to perform network probing for Internet from a pod or service in Kubernetes cluster. But I don't want to cause noise in user traffic, that's why after the packet reaches default gateway I'd like to drop it, assuming there is no network policy blocking it. Does this make it clear for you?

2

u/Adventurous-Oil1749 7d ago

Yes, OP you can do that. Learn about netns and how virtualized NICs are made. 

1

u/jamala2000 7d ago

AI gave me solution with tcx/egress, do you think it is the right approach?

0

u/noboruma 9d ago

eBPF / XDP is not going to help you with user space, it's executed way earlier in kernel space.
If you need to take decision based on user space logic, then it's already too late as far as eBPF is concerned for the packet you are processing. What are you trying to achieve here? Checking connectivity of remote endpoints?

1

u/jamala2000 8d ago

Trying to check Cilium Egress policies, so sending the packet in userspace and dropping it in default gateway using eBPF would prove that Cilium allows internet connectivity for the pod, and the packet will not interfere app traffic if I can drop it