bpftool-net(8)

💖 bpftool-net(8) — the "what's attached to my network stuff" manual 💖

okay bestie, this is the page for bpftool-net, straight out of the System Manager's Manual. It's the tool for inspection of networking related bpf prog attachments. Yes. That's the whole vibe. Let's go 🦋

---

✨ NAME ✨

bpftool-net — tool for inspection of networking related bpf prog attachments

---

🎀 SYNOPSIS 🎀

bpftool [OPTIONS] net COMMAND

OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -d | --debug } }

COMMANDS := { show | list | attach | detach | help }

---

🌸 NET COMMANDS 🌸

bpftool net { show | list } [ dev NAME ]
bpftool net attach ATTACH_TYPE PROG dev NAME [ overwrite | prepend ]
bpftool net detach ATTACH_TYPE dev NAME
bpftool net help

PROG := { id PROG_ID | pinned FILE | tag PROG_TAG | name PROG_NAME }
ATTACH_TYPE := { xdp | xdpgeneric | xdpdrv | xdpoffload | tcx_ingress | tcx_egress }

---

💅 DESCRIPTION 💅

bpftool net { show | list } [ dev NAME ]

This one lists bpf program attachments in the kernel networking subsystem. it's giving inventory check 💖

So like, right now (as in: in this version) the implemented things are device driver xdp attachments, tcx, netkit and old-style tc classifier/action attachments, flow_dissector as well as netfilter attachments — aka these program types:

• BPF_PROG_TYPE_XDP
• BPF_PROG_TYPE_SCHED_CLS
• BPF_PROG_TYPE_SCHED_ACT
• BPF_PROG_TYPE_FLOW_DISSECTOR
• BPF_PROG_TYPE_NETFILTER

Now for programs attached to a particular cgroup — you know, BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, BPF_PROG_TYPE_SOCK_OPS and BPF_PROG_TYPE_CGROUP_SOCK_ADDR — you're gonna want bpftool cgroup to dump cgroup attachments instead. And for sk_{filter, skb, msg, reuseport} and lwt/seg6 bpf programs, bestie, go consult other tools, e.g., iproute2. Not this one's job 🫶

The current output order is a whole storyline, keep up:

1. all xdp program attachments first,
2. then all tcx,
3. then netkit,
4. then tc class/qdisc bpf program attachments,
5. then flow_dissector,
6. and finally netfilter programs.

Both xdp programs and tcx/netkit/tc programs are ordered based on ifindex number. And if multiple bpf programs are attached to the same networking device through tc, the order goes like this: first all bpf programs attached to tcx, then netkit, then tc classes, then all bpf programs attached to non clsact qdiscs, and finally all bpf programs attached to root and clsact qdisc. periodt 👑

bpftool net attach ATTACH_TYPE PROG dev NAME [ overwrite | prepend ]

Attach bpf program PROG to network interface NAME with type specified by ATTACH_TYPE. slay, you're pinning a program to a NIC 💫

ATTACH_TYPE can be one of these beauties:

• xdp — try native XDP and fallback to generic XDP if NIC driver does not support it
• xdpgeneric — Generic XDP. runs at generic XDP hook when packet already enters receive path as skb
• xdpdrv — Native XDP. runs earliest point in driver's receive path
• xdpoffload — Offload XDP. runs directly on NIC on each packet reception
• tcx_ingress — Ingress TCX. runs on ingress net traffic
• tcx_egress — Egress TCX. runs on egress net traffic

For the XDP-related attach types (xdp, xdpgeneric, xdpdrv, xdpoffload), the overwrite option can be used to replace a previously attached bpf program. Out with the old 💀

For the tcx_ingress and tcx_egress attach types, the prepend option can be used to attach the program at the beginning of the chain instead of at the end. front of the line energy, literally 💅

bpftool net detach ATTACH_TYPE dev NAME

Detach bpf program attached to network interface NAME with type specified by ATTACH_TYPE. And listen: to detach a bpf program, the same ATTACH_TYPE previously used for attach must be specified. no switching up on it, fr fr 🙈

bpftool net help

Print short help message. cute and quick 🌈

---

⭐ OPTIONS ⭐

• -h, --help — Print short help message (similar to bpftool help).
• -V, --version — Print bpftool's version number (similar to bpftool version), the number of the libbpf version in use, and optional features that were included when bpftool was compiled. Those optional features include linking against LLVM or libbfd to provide the disassembler for JIT-ted programs (bpftool prog dump jited) and usage of BPF skeletons (some features like bpftool prog profile or showing pids associated to BPF objects may rely on it).
• -j, --json — Generate JSON output. For commands that cannot produce JSON, this option has no effect. (iykyk, sometimes there's just no JSON to give 😭)
• -p, --pretty — Generate human-readable JSON output. Implies -j.
• -d, --debug — Print all logs available, even debug-level information. This includes logs from libbpf as well as from the verifier, when attempting to load programs. maximum tea, all of it ☕🔥

---

🔥 EXAMPLES 🔥

The classic. Just run it:

# bpftool net

   xdp:
   eth0(2) driver id 198

   tc:
   eth0(2) htb name prefix_matcher.o:[cls_prefix_matcher_htb] id 111727 act []
   eth0(2) clsact/ingress fbflow_icmp id 130246 act []
   eth0(2) clsact/egress prefix_matcher.o:[cls_prefix_matcher_clsact] id 111726
   eth0(2) clsact/egress cls_fg_dscp id 108619 act []
   eth0(2) clsact/egress fbflow_egress id 130245

Now with JSON, pretty-printed:

# bpftool -jp net

   [{
           "xdp": [{
                   "devname": "eth0",
                   "ifindex": 2,
                   "mode": "driver",
                   "id": 198
               }
           ],
           "tc": [{
                   "devname": "eth0",
                   "ifindex": 2,
                   "kind": "htb",
                   "name": "prefix_matcher.o:[cls_prefix_matcher_htb]",
                   "id": 111727,
                   "act": []
               },{
                   "devname": "eth0",
                   "ifindex": 2,
                   "kind": "clsact/ingress",
                   "name": "fbflow_icmp",
                   "id": 130246,
                   "act": []
               },{
                   "devname": "eth0",
                   "ifindex": 2,
                   "kind": "clsact/egress",
                   "name": "prefix_matcher.o:[cls_prefix_matcher_clsact]",
                   "id": 111726,
               },{
                   "devname": "eth0",
                   "ifindex": 2,
                   "kind": "clsact/egress",
                   "name": "cls_fg_dscp",
                   "id": 108619,
                   "act": []
               },{
                   "devname": "eth0",
                   "ifindex": 2,
                   "kind": "clsact/egress",
                   "name": "fbflow_egress",
                   "id": 130245,
               }
           ]
       }
   ]

Attach a xdpdrv program, then peep the result:

# bpftool net attach xdpdrv id 16 dev enp6s0np0
# bpftool net

   xdp:
   enp6s0np0(4) driver id 16

Attach, then attach again with overwrite (the glow-up from id 16 to id 20):

# bpftool net attach xdpdrv id 16 dev enp6s0np0
# bpftool net attach xdpdrv id 20 dev enp6s0np0 overwrite
# bpftool net

   xdp:
   enp6s0np0(4) driver id 20

Attach, detach, and suddenly: nothing. empty. the xdp section is a ghost town 💀

# bpftool net attach xdpdrv id 16 dev enp6s0np0
# bpftool net detach xdpdrv dev enp6s0np0
# bpftool net

   xdp:

TCX ingress by name on lo:

# bpftool net attach tcx_ingress name tc_prog dev lo
# bpftool net

   tc:
   lo(1) tcx/ingress tc_prog prog_id 29

And with prepend, the new one jumps to the front of the chain. main character energy 👑

# bpftool net attach tcx_ingress name tc_prog2 dev lo prepend
# bpftool net

   tc:
   lo(1) tcx/ingress tc_prog2 prog_id 30
   lo(1) tcx/ingress tc_prog prog_id 29

And clean up after yourself, bestie:

# bpftool net attach tcx_ingress name tc_prog dev lo
# bpftool net detach tcx_ingress dev lo
# bpftool net

   tc:

---

🦋 SEE ALSO 🦋

bpf(2), bpf-helpers(7), bpftool(8), bpftool-btf(8), bpftool-cgroup(8), bpftool-feature(8), bpftool-gen(8), bpftool-iter(8), bpftool-link(8), bpftool-map(8), bpftool-perf(8), bpftool-prog(8), bpftool-struct_ops(8), bpftool-token(8)

---

okay that's the whole page bestie, you ate 💖 this came from the System Manager's Manual, page bpftool-net(8) — go forth and inspect those attachments 🌸✨