rustnet_host/linux/
mod.rs

1// Linux process attribution: eBPF (optional) with a procfs fallback.
2
3mod process;
4
5#[cfg(feature = "ebpf")]
6pub mod ebpf;
7#[cfg(feature = "ebpf")]
8mod enhanced;
9
10pub use process::LinuxProcessLookup;
11
12use crate::ProcessLookup;
13use anyhow::Result;
14
15/// Create a Linux process lookup implementation.
16/// Tries enhanced eBPF lookup first (if the feature is enabled), falls back to
17/// procfs. The `_use_pktap` parameter is ignored on Linux (macOS only).
18pub fn create_process_lookup(_use_pktap: bool) -> Result<Box<dyn ProcessLookup>> {
19    #[cfg(feature = "ebpf")]
20    {
21        // Try enhanced lookup first (with eBPF if available), fall back to basic
22        match enhanced::EnhancedLinuxProcessLookup::new() {
23            Ok(enhanced) => {
24                log::info!("Using enhanced Linux process lookup (eBPF + procfs)");
25                return Ok(Box::new(enhanced));
26            }
27            Err(e) => {
28                log::warn!(
29                    "Enhanced lookup failed, falling back to basic procfs: {}",
30                    e
31                );
32            }
33        }
34    }
35    // Use basic procfs lookup (either as fallback or when eBPF is not enabled)
36    log::info!("Using Linux process lookup (procfs)");
37    Ok(Box::new(LinuxProcessLookup::new()?))
38}
rustnet_host/linux/mod.rs

rustnet_host/linux/
mod.rs
