Struct EbpfFlowMonitor 

pub struct EbpfFlowMonitor { /* private fields */ }

Host-side eBPF flow monitor.

Owns the loaded aya BPF object (so it stays alive for the duration of the cell run — dropping aya::Ebpf detaches all programs) plus the receiver end of an mpsc channel into which the ring-buffer drainer task pushes FlowEvents.

Lifecycle:

1. EbpfFlowMonitor::start enters the cell’s netns, loads + attaches the BPF program, spawns the drainer task, and returns to the original netns.
2. The supervisor periodically calls EbpfFlowMonitor::drain (or consumes events directly via the channel) on its hot path.
3. EbpfFlowMonitor::stop aborts the drainer task and drops the aya object, which detaches the BPF program and releases the ring-buffer map.

The struct is constructed only via start; Default is intentionally not provided to prevent callers from skipping the netns + load sequence.

Implementations

impl EbpfFlowMonitor

pub async fn start( netns_fd: RawFd, tap_iface: &str, ) -> Result<Self, EbpfMonitorError>

Load and attach the BPF program inside the cell’s netns. Falls back to nflog (via the caller in per_flow.rs) if any step fails by returning an EbpfMonitorError.

netns_fd MUST be an open file descriptor for the cell’s /proc/<child_pid>/ns/net. The caller retains ownership. tap_iface is the supervisor-provisioned tap interface name (e.g. "vethC0").

pub fn drain(&mut self) -> Vec<FlowEvent>

Drain pending flow events into a Vec without blocking.

Used by callers that want a synchronous batch pull instead of .recv().await per event. Returns an empty Vec when no events are buffered.

pub async fn recv(&mut self) -> Option<FlowEvent>

Async pull of one event. Returns None when the drainer task has exited (i.e. the channel sender side has been dropped).

pub async fn stop(self)

Stop the monitor and clean up. Aborts the drainer task; dropping the held [aya::Ebpf] object detaches the BPF program.