Linux Kernel Journey

Dec 24, 2024 · Operations

How to Use tcpw with eBPF to Capture Curl’s Five‑Tuple Information

This article introduces tcpw, a small eBPF‑based utility that traces TCP, UDP, and Unix‑domain sockets to display the five‑tuple of commands like curl or telnet, explains its command‑line options, shows concrete usage examples, and details the underlying BPF and Go implementation, including connect, accept, and fork tracing.