Prog type • ebpf provide various programs type for different purpose - We choose SOCK_OPS & SK_SKB to implement function enum bpf_prog_type { BPF_PROG_TYPE_UNSPEC, BPF_PROG_TYPE_SOCKET_FILTER SOCK_OPS program to global cgroup - Capture socket in established state and add to hashmap • Attach sk_skb program to hashmap - When socket send a msg, lookup peer socket in sockmap • Redirect ![Image