eBPF/XDP Network Filters

A collection of eBPF (Extended Berkeley Packet Filter) scripts using the BCC (BPF Compiler Collection) framework to filter and monitor network traffic at the XDP (eXpress Data Path) layer.

Overview

These scripts demonstrate how to attach XDP programs to a network interface (e.g., Wi-Fi or Ethernet) in Generic (SKB) mode to drop specific traffic or observe packets before they reach the main Linux network stack.

Included Files

• block_chatgpt7.py: An advanced domain blocker. It harvests multiple A and AAAA records (IPv4 and IPv6) via DNS lookups, populates BPF maps, and drops incoming packets matching those source IPs.
• block_chatgpt4.py: A protocol-specific filter that drops all incoming IPv4 ICMP (ping) traffic while allowing other traffic to pass.
• debug_xdp.py: A lightweight diagnostic tool. It attaches to the interface and prints the length of every packet it sees, useful for verifying that XDP is successfully bound to your hardware.

Prerequisites

• Linux Kernel with eBPF and XDP support enabled.
• bcc tools and python3-bpfcc installed.
• Root (sudo) privileges to load eBPF programs and attach them to network interfaces.

Usage

1. Open the script you want to run and update the device = "..." variable to match your target network interface (e.g., wlo1, eth0).
2. Run the script with elevated privileges:

   sudo python3 filename.py
   
   
   

Authors: Bhattacharya Brothers (Soham Bhattacharya, Darpan Bhattacharya)

Project for Deep Learning for CyberSecurity (DLCS) course as part of M.Sc. in Big Data Analytics programme at RKMVERI