I'd like to use pktstat-bpf from a script to determine if the total bandwidth usage of a specific cgroup in the last x seconds exceeded a threshold.
I can currently do that by parsing the output and adding the per-stream bytes up using e.g. awk, but this isn't terribly efficient; it would be great if pktstat-bpf could do this itself.
I imagine even the eBPF code might be simpler/faster if per-stream statistics are not required.
Thanks!