Deep Technical Architecture

eBPF Kernel Probing & Zero-Copy Packet Telemetry Pipeline

How NETSTATS intercepts Linux kernel TCP sockets, parses XDP frames at 100Gbps line-rate, and computes sub-millisecond p99 latency without introducing user-space context switches.

Telemetry Ingestion Pipeline (Kernel to Edge Collector)

Kernel Subsystem 01

eBPF Socket Hooking

Unlike legacy packet capture (libpcap) which copies full packet payloads across kernel-user boundaries, NETSTATS attaches BPF bytecode programs directly to kernel tracepoints:

• kprobe/tcp_v4_connect: Measures exact nanosecond timestamp when SYN frame leaves socket.
• kretprobe/tcp_v4_connect: Records SYN-ACK arrival, computing true TCP Round Trip Time (RTT).
• tracepoint/sock/inet_sock_set_state: Tracks TCP state changes (ESTABLISHED, CLOSE_WAIT, FIN_WAIT).

Kernel Subsystem 02

XDP Acceleration Layer

eXpress Data Path runs in the network driver before Linux allocates memory for the packet descriptor (sk_buff). This enables ultra-low-latency packet telemetry:

• Driver-Level Hook: Executes in IXGBE / I40E / Mellanox ConnectX NIC drivers.
• Fast Path Drop: Drops malformed UDP/ICMP flood attacks before reaching IP stack.
• Zero Allocation: Extracts IP headers & TCP flags directly from DMA ring buffers.

Telemetry Subsystem 03

BGP Route Flap Telemetry

NETSTATS Edge collectors interface directly with Tier-1 BGP routers via MRT format feeds and BGP monitoring protocol (BMP, RFC 7854):

• AS-Path Churn Index: Detects path hunting anomalies across global transit providers.
• Sub-Second Dampening: Evaluates route flap scores using exponential decay metrics.
• Prefix Hijack Detection: Cross-references RPKI ROA state with active announcements.

Performance Benchmark Simulator

Compare Traditional PCAP vs. NETSTATS eBPF

Adjust incoming network packet throughput (Packets Per Second) to observe CPU overhead and memory footprint differences.

Packet Rate (pps): 1,000,000 pps

TRADITIONAL PCAP / PROMISCUOUS

CPU Usage: 18.4% Packet Drop: 2.41%

NETSTATS eBPF / XDP ENGINE

CPU Usage: 0.31% Packet Drop: 0.00%

Kernel Memory Allocation & Probe Overhead

Legacy Libpcap Context Switches 1,000,000 ctx/sec

NETSTATS eBPF BPF_MAP RingBuffer 0 ctx/sec (Kernel Space)

Probe Latency Added per Packet < 3.2 nanoseconds

Production Source Code

eBPF C Kernel Program (`telemetry_kprobe.c`)

View full SDK documentation →

bpf/telemetry_kprobe.c Target: Linux 5.15+ (CO-RE BPF)

#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

char LICENSE[] SEC("license") = "Dual BSD/GPL";

struct socket_event {
    u32 src_ip;
    u32 dst_ip;
    u16 src_port;
    u16 dst_port;
    u64 latency_ns;
    u32 rx_bytes;
    u16 tcp_flags;
};

struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024);
} telemetry_ringbuf SEC(".maps");

SEC("kprobe/tcp_v4_connect")
int BPF_KPROBE(trace_tcp_v4_connect, struct sock *sk) {
    u64 ts = bpf_ktime_get_ns();
    
    struct socket_event *event;
    event = bpf_ringbuf_reserve(&telemetry_ringbuf, sizeof(*event), 0);
    if (!event) return 0;

    event->src_ip = BPF_CORE_READ(sk, __sk_common.skc_rcv_saddr);
    event->dst_ip = BPF_CORE_READ(sk, __sk_common.skc_daddr);
    event->src_port = BPF_CORE_READ(sk, __sk_common.skc_num);
    event->dst_port = BPF_CORE_READ(sk, __sk_common.skc_dport);
    event->latency_ns = ts;

    bpf_ringbuf_submit(event, 0);
    return 0;
}