If I understood well there are different ebpf loaders:
- bpf_load.c into the kernel source code
- libbpf
- bpftool
- tc
- ... <-- others?
Which are the main differences between them? Are they always interchangeably? Should I always prefer libbpf?
If I understood well there are different ebpf loaders:
Which are the main differences between them? Are they always interchangeably? Should I always prefer libbpf?
Copyright © 2021 Jogjafile Inc.
In their last versions, bpftool, bcc, and
bpf_load.c
use libbpf. iproute2, and thereforetc
, uses its own wrappers for BPF syscalls.There likely are differences in APIs between libbpf and iproute2's own wrapper. You should prefer libbpf as it's becoming the standard (I think the plan it to use it in iproute2 as well).