netwatch-sdk 0.4.0

Shared wire-format types and collectors for NetWatch Cloud — the SDK consumed by netwatch-agent and the NetWatch Cloud server. Parses /proc, ss, lsof, nettop, and libpcap events into a common Snapshot payload.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

//! eBPF event source.
//!
//! This module is the userspace half of the netwatch-sdk eBPF integration.
//! It loads the BPF object compiled from `crates/ebpf-programs`, attaches
//! the kprobes, and surfaces a channel of decoded events.
//!
//! Status: Phase 1 of the [eBPF roadmap](../../docs/plans/ebpf.md). Today
//! this provides the public API surface and the userspace ring-buffer
//! reader for `tcp_v4_connect`. The kprobe itself is committed in
//! `crates/ebpf-programs/src/main.rs` and is built via
//! `scripts/build-ebpf.sh`.
//!
//! # Availability
//!
//! - **Linux only.** On other targets, the `ebpf` Cargo feature still
//!   compiles (so cross-platform builds don't break) but
//!   [`EventSource::new`] returns `Err(EbpfError::UnsupportedPlatform)`.
//! - **Kernel ≥ 5.10.** Older kernels lack reliable BTF and `CAP_BPF`.
//! - Requires `CAP_BPF` + `CAP_PERFMON` (or root). The agent crate gates
//!   the call site on the running uid; `EventSource::new` itself returns
//!   a clear error rather than panicking when permissions are missing.

mod event;
mod source;

pub use event::{ConnectEvent, EbpfEvent, Protocol};
pub use source::{EbpfError, EventSource};