Module ebpf 

The event the eBPF program reports (crates/backends/netwatch-ebpf, Event): #[repr(C)] { cgroup: u64, tgid: u32, hook: u32, len: u32, captured: u32, netns: u32, cgflags: u32, cgpath: [[u8; NAME]; LEVELS], data: [u8; CAPTURE] }, native-endian. Parsed by hand: no unsafe, and a short buffer is an error rather than a misread.

Structs

Event

Constants

CAPTURE

CG_ROOT

In cgflags: the probe’s walk reached the root, so cgpath is whole.

EVENT_SIZE

HEADER 🔒

HOOK_GENL

HOOK_NETDEV

register_netdevice: an interface registered, of any kind; data is its name, netns its own.

HOOK_NFBATCH

nfnetlink_rcv_batch: an nftables batch (its header is the batch’s).

HOOK_NFNETLINK

HOOK_RTNETLINK

HOOK_SOCKOPT

nf_setsockopt: a legacy table change; data is pf then the option.

LEVELS

NAME

Functions

cgpath 🔒

The whole path from the probe’s leaf-first names, or None if the walk did not reach the root or a name filled its slot (may be cut short).