netdata/collectors/ebpf.plugin/ebpf.d/network.conf

# The `ebpf load mode` option accepts the following values :
#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
#            new charts for the return of these functions, such as errors.
#
# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
# or `cgroups.plugin`.
# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
# the setting `apps` and `cgroups` to  'no'.
#
# The following options change the hash table size:
#  `bandwidth table size`: Maximum number of connections monitored
#  `ipv4 connection table size`: Maximum number of IPV4 connections monitored
#  `ipv6 connection table size`: Maximum number of IPV6 connections monitored
#  `udp connection table size`: Maximum number of UDP connections monitored
#
# The `ebpf type format` option accepts the following values :
#  `auto`  : The eBPF collector will investigate hardware and select between the two next options.
#  `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
#  `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
#
# The `ebpf co-re tracing` option accepts the following values:
#   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
#   `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
#   `probe`     : This is the same as legacy code.
#
# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
#
# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
#   `real parent`: Only stores real parent inside PID
#   `parent`     : Only stores parent PID.
#   `all`        : Stores all PIDs used by software. This is the most expensive option.
#
# The `lifetime` defines the time length a thread will run when it is enabled by a function.
#
# Uncomment lines to define specific options for thread.
[global]
#    ebpf load mode = entry
#    apps = yes
#    cgroups = no
#    update every = 10
    bandwidth table size = 16384
    socket monitoring table size = 16384
    udp connection table size = 4096
    ebpf type format = auto
    ebpf co-re tracing = probe
    maps per core = no
    collect pid = all
    lifetime = 300

#
# Network Connection
#
# This is a feature with status WIP(Work in Progress)
#
[network connections]
    enabled = yes
    resolve hostnames = no
    resolve service names = yes
    ports = *
#    ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128
    ips = *
    hostnames = *

[service name]
    19999 = Netdata