Xdpcap: XDP Packet Capture

xdpcap can write packets to a pcap file:

Or write the pcap to stdout, and decode the packets with tcpdump:

The remainder of this post explains how we built xdpcap, including how is used to attach to XDP programs. Returning to our example filter, compiles to the following cBPF program, expressed as an annotated flowchart:

Tcpdump attaches the generated cBPF filter to a raw packet socket using a system call with . In the context of XDP, our tcpdump replacement should:

XDP uses an extended version of the cBPF instruction set, eBPF, to allow arbitrary programs to run for each packet received by a network card, potentially modifying the packets.

Source: blog.cloudflare.com