* feat: Add experimental eBPF support for enhanced socket tracking
- Implement eBPF-based socket tracker for Linux with CO-RE support
- Add minimal vmlinux header (5.5KB) instead of full 3.4MB file
- Create graceful fallback mechanism to procfs when eBPF unavailable
- Add comprehensive eBPF build documentation
- Integrate libbpf-rs for eBPF program loading and management
- Support both IPv4 and IPv6 socket tracking
- Add capability checking for required permissions
The eBPF feature is optional and disabled by default. When enabled,
it provides faster and more accurate process-to-socket mapping on
Linux systems with appropriate permissions.
- Added SSH Deep Packet Inspection (DPI) with comprehensive protocol analysis
- Enhanced connection filtering with SSH-specific filters
- Improved CI/CD with path-based GitHub Actions triggers
- Updated documentation with SSH examples and state descriptions
Marco Cadetg