Local Map Commands

Local eBPF map commands

Purpose #

Inspect or clear pinned eBPF maps on the hypervisor that runs the Virtualization Agent.

Prerequisites #

• Root on the Agent host
• Pin dir (zwallctl default /sys/fs/bpf/fw; virt unit ReadWritePaths includes /sys/fs/bpf)
• Maps actually pinned (ebpf.enable_pinned_maps: true)

Config key: pin_dir in ~/.zwallctl/config.yml or --pin-dir.

Commands #

zwallctl map ls [map-name] #

Purpose. List maps or entries.
Example. zwallctl map ls / zwallctl map ls blocked_ips
Expected output. Map names or key/value rows. Empty → wrong pin dir or Agent not running.
Errors. Permission denied without CAP_SYS_ADMIN/root.

zwallctl map clear \ #

Purpose. Clear a pinned map. Destructive for live enforcement.
Example. sudo zwallctl map clear blocked_macs
Security. Can unblock traffic immediately on that host only.

zwallctl map pin #

Purpose. Pin maps into --pin-dir.
Edition. SHARED.

There is no cobra map dump / firewall list despite some in-tree README folklore.

zwallctl stats calls map ls for stats_map — not Prometheus.

Enterprise local-tracker #

zwallctl local-tracker list --map port_scan_tracker
zwallctl local-tracker clear 203.0.113.10
zwallctl local-tracker clear --allCopy

Purpose. Inspect/clear local tracker maps on the Agent host.
Edition. ENTERPRISE_ONLY cobra file.
Example IP. RFC 5737 203.0.113.10.
Security. --all is host-wide.

Related #

• Virtualization XDP/TC
• Operator commands