eBPF Linux Traffic Statistics and Bandwidth usage
Budget: £750 – £1,500 GBP
I would like program that uses eBPF to capture traffic stats in Linux. I would like to track data usage by IP and by process.
Sample output in JSON:
{
"timestamp": "2025-01-28T18:52:14Z",
"traffic_stats": {
"processes": {
"firefox": {
"93.184.216.34": {
"upload": 1024,
"download": 2048
},
"151.101.1.69": {
"upload": 512,
"download": 1024
}
},
"chrome": {
"172.217.16.142": {
"upload": 2048,
"download": 4096
}
},
"ssh": {
"192.0.2.1": {
"upload": 256,
"download": 512
}
}
}
}
}
And I would also like an option for Influx Line Protocol:
traffic_stats,process=firefox,ip=93.184.216.34 upload=1024,download=2048 1611859934000000000
traffic_stats,process=firefox,ip=151.101.1.69 upload=512,download=1024 1611859934000000000
traffic_stats,process=chrome,ip=172.217.16.142 upload=2048,download=4096 1611859934000000000
traffic_stats,process=ssh,ip=192.0.2.1 upload=256,download=512 1611859934000000000
It needs to work with:
Ubuntu 20.04 with kernel 5.15
Ubuntu 24.04 with kernel 6.8
It needs some options to separate local traffic because I am mostly interested in bandwidth usage.
Sample output in JSON:
{
"timestamp": "2025-01-28T18:52:14Z",
"traffic_stats": {
"processes": {
"firefox": {
"93.184.216.34": {
"upload": 1024,
"download": 2048
},
"151.101.1.69": {
"upload": 512,
"download": 1024
}
},
"chrome": {
"172.217.16.142": {
"upload": 2048,
"download": 4096
}
},
"ssh": {
"192.0.2.1": {
"upload": 256,
"download": 512
}
}
}
}
}
And I would also like an option for Influx Line Protocol:
traffic_stats,process=firefox,ip=93.184.216.34 upload=1024,download=2048 1611859934000000000
traffic_stats,process=firefox,ip=151.101.1.69 upload=512,download=1024 1611859934000000000
traffic_stats,process=chrome,ip=172.217.16.142 upload=2048,download=4096 1611859934000000000
traffic_stats,process=ssh,ip=192.0.2.1 upload=256,download=512 1611859934000000000
It needs to work with:
Ubuntu 20.04 with kernel 5.15
Ubuntu 24.04 with kernel 6.8
It needs some options to separate local traffic because I am mostly interested in bandwidth usage.