diff --git a/bpf/pca.h b/bpf/pca.h index 8ef97e15f..295f983b1 100644 --- a/bpf/pca.h +++ b/bpf/pca.h @@ -66,6 +66,11 @@ static inline bool validate_pca_filter(struct __sk_buff *skb, direction dir) { } static inline int export_packet_payload(struct __sk_buff *skb, direction dir) { + // If sampling is defined, will only parse 1 out of "sampling" flows + if (sampling > 1 && (bpf_get_prandom_u32() % sampling) != 0) { + return 0; + } + void *data_end = (void *)(long)skb->data_end; void *data = (void *)(long)skb->data; diff --git a/pkg/agent/packets_agent.go b/pkg/agent/packets_agent.go index 0cb8aad46..87e1ab033 100644 --- a/pkg/agent/packets_agent.go +++ b/pkg/agent/packets_agent.go @@ -77,6 +77,7 @@ func PacketsAgent(cfg *Config) (*Packets, error) { EnableIngress: ingress, EnableEgress: egress, Debug: debug, + Sampling: cfg.Sampling, CacheMaxSize: cfg.CacheMaxFlows, EnablePCA: cfg.EnablePCA, FilterConfig: &ebpf.FilterConfig{ diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o index 40cc6525c..3141e9564 100644 Binary files a/pkg/ebpf/bpf_arm64_bpfel.o and b/pkg/ebpf/bpf_arm64_bpfel.o differ diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o index 1f8187466..c9f16da10 100644 Binary files a/pkg/ebpf/bpf_powerpc_bpfel.o and b/pkg/ebpf/bpf_powerpc_bpfel.o differ diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o index 9a12cd1e7..ee345e637 100644 Binary files a/pkg/ebpf/bpf_s390_bpfeb.o and b/pkg/ebpf/bpf_s390_bpfeb.o differ diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o index 5e4d7d770..618488d29 100644 Binary files a/pkg/ebpf/bpf_x86_bpfel.o and b/pkg/ebpf/bpf_x86_bpfel.o differ diff --git a/pkg/ebpf/tracer.go b/pkg/ebpf/tracer.go index 92add5b20..9e3a0aa12 100644 --- a/pkg/ebpf/tracer.go +++ b/pkg/ebpf/tracer.go @@ -726,6 +726,7 @@ func NewPacketFetcher(cfg *FlowFetcherConfig) (*PacketFetcher, error) { } if err := spec.RewriteConstants(map[string]interface{}{ + constSampling: uint32(cfg.Sampling), constPcaEnable: uint8(pcaEnable), }); err != nil { return nil, fmt.Errorf("rewriting BPF constants definition: %w", err)