Adding upstream version 1.43.0.upstream/1.43.0

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 725 insertions, 1981 deletions

diff --git a/collectors/ebpf.plugin/ebpf_socket.c b/collectors/ebpf.plugin/ebpf_socket.c
index e4798b30c..3e3897551 100644
--- a/collectors/ebpf.plugin/ebpf_socket.c
+++ b/collectors/ebpf.plugin/ebpf_socket.c
@@ -5,9 +5,6 @@
 #include "ebpf.h"
 #include "ebpf_socket.h"
 
-// ----------------------------------------------------------------------------
-// ARAL vectors used to speed up processing
-
 /*****************************************************************
  *
  *  GLOBAL VARIABLES
@@ -23,16 +20,7 @@ static char *socket_id_names[NETDATA_MAX_SOCKET_VECTOR] = { "tcp_cleanup_rbuf",
                                                             "tcp_connect_v4", "tcp_connect_v6", "inet_csk_accept_tcp",
                                                             "inet_csk_accept_udp" };
 
-static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_bandwidth",
-                                           .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
-                                           .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
-                                           .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
-                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED,
-#ifdef LIBBPF_MAJOR_VERSION
-                                           .map_type = BPF_MAP_TYPE_PERCPU_HASH
-#endif
-                                          },
-                                          {.name = "tbl_global_sock",
+static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_global_sock",
                                            .internal_input = NETDATA_SOCKET_COUNTER,
                                            .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED,
@@ -48,16 +36,7 @@ static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_bandwidth",
                                            .map_type = BPF_MAP_TYPE_PERCPU_HASH
 #endif
                                            },
-                                          {.name = "tbl_conn_ipv4",
-                                           .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
-                                           .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
-                                           .type = NETDATA_EBPF_MAP_STATIC,
-                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED,
-#ifdef LIBBPF_MAJOR_VERSION
-                                           .map_type = BPF_MAP_TYPE_PERCPU_HASH
-#endif
-                                          },
-                                          {.name = "tbl_conn_ipv6",
+                                           {.name = "tbl_nd_socket",
                                            .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
                                            .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
                                            .type = NETDATA_EBPF_MAP_STATIC,
@@ -93,11 +72,6 @@ static netdata_idx_t *socket_hash_values = NULL;
 static netdata_syscall_stat_t socket_aggregated_data[NETDATA_MAX_SOCKET_VECTOR];
 static netdata_publish_syscall_t socket_publish_aggregated[NETDATA_MAX_SOCKET_VECTOR];
 
-static ebpf_bandwidth_t *bandwidth_vector = NULL;
-
-pthread_mutex_t nv_mutex;
-netdata_vector_plot_t inbound_vectors = { .plot = NULL, .next = 0, .last = 0 };
-netdata_vector_plot_t outbound_vectors = { .plot = NULL, .next = 0, .last = 0 };
 netdata_socket_t *socket_values;
 
 ebpf_network_viewer_port_list_t *listen_ports = NULL;
@@ -108,28 +82,30 @@ struct config socket_config = { .first_section = NULL,
     .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
         .rwlock = AVL_LOCK_INITIALIZER } };
 
-netdata_ebpf_targets_t socket_targets[] = { {.name = "inet_csk_accept", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_retransmit_skb", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_cleanup_rbuf", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_close", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "udp_recvmsg", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_sendmsg", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "udp_sendmsg", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_v4_connect", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_v6_connect", .mode = EBPF_LOAD_TRAMPOLINE},
+netdata_ebpf_targets_t socket_targets[] = { {.name = "inet_csk_accept", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_retransmit_skb", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_cleanup_rbuf", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_close", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "udp_recvmsg", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_sendmsg", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "udp_sendmsg", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_v4_connect", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_v6_connect", .mode = EBPF_LOAD_PROBE},
                                             {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE}};
 
-struct netdata_static_thread socket_threads = {
-    .name = "EBPF SOCKET READ",
-    .config_section = NULL,
-    .config_name = NULL,
-    .env_name = NULL,
-    .enabled = 1,
-    .thread = NULL,
-    .init_routine = NULL,
-    .start_routine = NULL
+struct netdata_static_thread ebpf_read_socket = {
+        .name = "EBPF_READ_SOCKET",
+        .config_section = NULL,
+        .config_name = NULL,
+        .env_name = NULL,
+        .enabled = 1,
+        .thread = NULL,
+        .init_routine = NULL,
+        .start_routine = NULL
 };
 
+ARAL *aral_socket_table = NULL;
+
 #ifdef NETDATA_DEV_MODE
 int socket_disable_priority;
 #endif
@@ -145,7 +121,9 @@ int socket_disable_priority;
 static void ebpf_socket_disable_probes(struct socket_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_inet_csk_accept_kretprobe, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kretprobe, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kretprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_retransmit_skb_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_cleanup_rbuf_kprobe, false);
@@ -156,7 +134,6 @@ static void ebpf_socket_disable_probes(struct socket_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kretprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_socket_release_task_kprobe, false);
 }
 
 /**
@@ -168,8 +145,10 @@ static void ebpf_socket_disable_probes(struct socket_bpf *obj)
  */
 static void ebpf_socket_disable_trampoline(struct socket_bpf *obj)
 {
-    bpf_program__set_autoload(obj->progs.netdata_inet_csk_accept_fentry, false);
+    bpf_program__set_autoload(obj->progs.netdata_inet_csk_accept_fexit, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fexit, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fexit, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_retransmit_skb_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_cleanup_rbuf_fentry, false);
@@ -180,7 +159,6 @@ static void ebpf_socket_disable_trampoline(struct socket_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_fexit, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fexit, false);
-    bpf_program__set_autoload(obj->progs.netdata_socket_release_task_fentry, false);
 }
 
 /**
@@ -190,12 +168,18 @@ static void ebpf_socket_disable_trampoline(struct socket_bpf *obj)
  */
 static void ebpf_set_trampoline_target(struct socket_bpf *obj)
 {
-    bpf_program__set_attach_target(obj->progs.netdata_inet_csk_accept_fentry, 0,
+    bpf_program__set_attach_target(obj->progs.netdata_inet_csk_accept_fexit, 0,
                                    socket_targets[NETDATA_FCNT_INET_CSK_ACCEPT].name);
 
+    bpf_program__set_attach_target(obj->progs.netdata_tcp_v4_connect_fentry, 0,
+                                   socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
+
     bpf_program__set_attach_target(obj->progs.netdata_tcp_v4_connect_fexit, 0,
                                    socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
 
+    bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fentry, 0,
+                                   socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
+
     bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fexit, 0,
                                    socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
 
@@ -205,7 +189,8 @@ static void ebpf_set_trampoline_target(struct socket_bpf *obj)
     bpf_program__set_attach_target(obj->progs.netdata_tcp_cleanup_rbuf_fentry, 0,
                                    socket_targets[NETDATA_FCNT_CLEANUP_RBUF].name);
 
-    bpf_program__set_attach_target(obj->progs.netdata_tcp_close_fentry, 0, socket_targets[NETDATA_FCNT_TCP_CLOSE].name);
+    bpf_program__set_attach_target(obj->progs.netdata_tcp_close_fentry, 0,
+                                   socket_targets[NETDATA_FCNT_TCP_CLOSE].name);
 
     bpf_program__set_attach_target(obj->progs.netdata_udp_recvmsg_fentry, 0,
                                    socket_targets[NETDATA_FCNT_UDP_RECEVMSG].name);
@@ -224,8 +209,6 @@ static void ebpf_set_trampoline_target(struct socket_bpf *obj)
 
     bpf_program__set_attach_target(obj->progs.netdata_udp_sendmsg_fexit, 0,
                                    socket_targets[NETDATA_FCNT_UDP_SENDMSG].name);
-
-    bpf_program__set_attach_target(obj->progs.netdata_socket_release_task_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 
@@ -241,9 +224,13 @@ static inline void ebpf_socket_disable_specific_trampoline(struct socket_bpf *ob
 {
     if (sel == MODE_RETURN) {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_fentry, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fentry, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fentry, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fentry, false);
     } else {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_fexit, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fexit, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fexit, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fexit, false);
     }
 }
@@ -260,9 +247,13 @@ static inline void ebpf_socket_disable_specific_probe(struct socket_bpf *obj, ne
 {
     if (sel == MODE_RETURN) {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_kprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kprobe, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kprobe, false);
     } else {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_kretprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kretprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kretprobe, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kretprobe, false);
     }
 }
@@ -275,26 +266,12 @@ static inline void ebpf_socket_disable_specific_probe(struct socket_bpf *obj, ne
  * @param obj is the main structure for bpf objects.
  * @param sel option selected by user.
  */
-static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t sel)
+static long ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t sel)
 {
     obj->links.netdata_inet_csk_accept_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_inet_csk_accept_kretprobe,
                                                                               true,
                                                                               socket_targets[NETDATA_FCNT_INET_CSK_ACCEPT].name);
-    int ret = libbpf_get_error(obj->links.netdata_inet_csk_accept_kretprobe);
-    if (ret)
-            return -1;
-
-    obj->links.netdata_tcp_v4_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v4_connect_kretprobe,
-                                                                             true,
-                                                                             socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
-    ret = libbpf_get_error(obj->links.netdata_tcp_v4_connect_kretprobe);
-    if (ret)
-        return -1;
-
-    obj->links.netdata_tcp_v6_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kretprobe,
-                                                                             true,
-                                                                             socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
-    ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kretprobe);
+    long ret = libbpf_get_error(obj->links.netdata_inet_csk_accept_kretprobe);
     if (ret)
         return -1;
 
@@ -347,6 +324,20 @@ static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
         ret = libbpf_get_error(obj->links.netdata_udp_sendmsg_kretprobe);
         if (ret)
             return -1;
+
+        obj->links.netdata_tcp_v4_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v4_connect_kretprobe,
+                                                                                 true,
+                                                                                 socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v4_connect_kretprobe);
+        if (ret)
+            return -1;
+
+        obj->links.netdata_tcp_v6_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kretprobe,
+                                                                                 true,
+                                                                                 socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kretprobe);
+        if (ret)
+            return -1;
     } else {
         obj->links.netdata_tcp_sendmsg_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_sendmsg_kprobe,
                                                                            false,
@@ -361,13 +352,21 @@ static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
         ret = libbpf_get_error(obj->links.netdata_udp_sendmsg_kprobe);
         if (ret)
             return -1;
-    }
 
-    obj->links.netdata_socket_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_socket_release_task_kprobe,
-                                                                               false,  EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = libbpf_get_error(obj->links.netdata_socket_release_task_kprobe);
-    if (ret)
-        return -1;
+        obj->links.netdata_tcp_v4_connect_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v4_connect_kprobe,
+                                                                              false,
+                                                                              socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v4_connect_kprobe);
+        if (ret)
+            return -1;
+
+        obj->links.netdata_tcp_v6_connect_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kprobe,
+                                                                              false,
+                                                                              socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kprobe);
+        if (ret)
+            return -1;
+    }
 
     return 0;
 }
@@ -381,11 +380,9 @@ static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
  */
 static void ebpf_socket_set_hash_tables(struct socket_bpf *obj)
 {
-    socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH].map_fd = bpf_map__fd(obj->maps.tbl_bandwidth);
     socket_maps[NETDATA_SOCKET_GLOBAL].map_fd = bpf_map__fd(obj->maps.tbl_global_sock);
     socket_maps[NETDATA_SOCKET_LPORTS].map_fd = bpf_map__fd(obj->maps.tbl_lports);
-    socket_maps[NETDATA_SOCKET_TABLE_IPV4].map_fd = bpf_map__fd(obj->maps.tbl_conn_ipv4);
-    socket_maps[NETDATA_SOCKET_TABLE_IPV6].map_fd = bpf_map__fd(obj->maps.tbl_conn_ipv6);
+    socket_maps[NETDATA_SOCKET_OPEN_SOCKET].map_fd = bpf_map__fd(obj->maps.tbl_nd_socket);
     socket_maps[NETDATA_SOCKET_TABLE_UDP].map_fd = bpf_map__fd(obj->maps.tbl_nv_udp);
     socket_maps[NETDATA_SOCKET_TABLE_CTRL].map_fd = bpf_map__fd(obj->maps.socket_ctrl);
 }
@@ -400,22 +397,13 @@ static void ebpf_socket_set_hash_tables(struct socket_bpf *obj)
  */
 static void ebpf_socket_adjust_map(struct socket_bpf *obj, ebpf_module_t *em)
 {
-    ebpf_update_map_size(obj->maps.tbl_bandwidth, &socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH],
-                         em, bpf_map__name(obj->maps.tbl_bandwidth));
-
-    ebpf_update_map_size(obj->maps.tbl_conn_ipv4, &socket_maps[NETDATA_SOCKET_TABLE_IPV4],
-                         em, bpf_map__name(obj->maps.tbl_conn_ipv4));
-
-    ebpf_update_map_size(obj->maps.tbl_conn_ipv6, &socket_maps[NETDATA_SOCKET_TABLE_IPV6],
-                         em, bpf_map__name(obj->maps.tbl_conn_ipv6));
+    ebpf_update_map_size(obj->maps.tbl_nd_socket, &socket_maps[NETDATA_SOCKET_OPEN_SOCKET],
+                         em, bpf_map__name(obj->maps.tbl_nd_socket));
 
     ebpf_update_map_size(obj->maps.tbl_nv_udp, &socket_maps[NETDATA_SOCKET_TABLE_UDP],
                          em, bpf_map__name(obj->maps.tbl_nv_udp));
 
-
-    ebpf_update_map_type(obj->maps.tbl_bandwidth, &socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH]);
-    ebpf_update_map_type(obj->maps.tbl_conn_ipv4, &socket_maps[NETDATA_SOCKET_TABLE_IPV4]);
-    ebpf_update_map_type(obj->maps.tbl_conn_ipv6, &socket_maps[NETDATA_SOCKET_TABLE_IPV6]);
+    ebpf_update_map_type(obj->maps.tbl_nd_socket, &socket_maps[NETDATA_SOCKET_OPEN_SOCKET]);
     ebpf_update_map_type(obj->maps.tbl_nv_udp, &socket_maps[NETDATA_SOCKET_TABLE_UDP]);
     ebpf_update_map_type(obj->maps.socket_ctrl, &socket_maps[NETDATA_SOCKET_TABLE_CTRL]);
     ebpf_update_map_type(obj->maps.tbl_global_sock, &socket_maps[NETDATA_SOCKET_GLOBAL]);
@@ -459,7 +447,7 @@ static inline int ebpf_socket_load_and_attach(struct socket_bpf *obj, ebpf_modul
     if (test == EBPF_LOAD_TRAMPOLINE) {
         ret = socket_bpf__attach(obj);
     } else {
-        ret = ebpf_socket_attach_probes(obj, em->mode);
+        ret = (int)ebpf_socket_attach_probes(obj, em->mode);
     }
 
     if (!ret) {
@@ -479,211 +467,392 @@ static inline int ebpf_socket_load_and_attach(struct socket_bpf *obj, ebpf_modul
  *****************************************************************/
 
 /**
- * Clean internal socket plot
+ * Socket Free
  *
- * Clean all structures allocated with strdupz.
+ * Cleanup variables after child threads to stop
  *
- * @param ptr the pointer with addresses to clean.
+ * @param ptr thread data.
  */
-static inline void clean_internal_socket_plot(netdata_socket_plot_t *ptr)
+static void ebpf_socket_free(ebpf_module_t *em )
 {
-    freez(ptr->dimension_recv);
-    freez(ptr->dimension_sent);
-    freez(ptr->resolved_name);
-    freez(ptr->dimension_retransmit);
+    pthread_mutex_lock(&ebpf_exit_cleanup);
+    em->enabled = NETDATA_THREAD_EBPF_STOPPED;
+    ebpf_update_stats(&plugin_statistics, em);
+    ebpf_update_kernel_memory_with_vector(&plugin_statistics, em->maps, EBPF_ACTION_STAT_REMOVE);
+    pthread_mutex_unlock(&ebpf_exit_cleanup);
 }
 
 /**
- * Clean socket plot
+ *  Obsolete Systemd Socket Charts
  *
- * Clean the allocated data for inbound and outbound vectors.
-static void clean_allocated_socket_plot()
-{
-    if (!network_viewer_opt.enabled)
-        return;
-
-    uint32_t i;
-    uint32_t end = inbound_vectors.last;
-    netdata_socket_plot_t *plot = inbound_vectors.plot;
-    for (i = 0; i < end; i++) {
-        clean_internal_socket_plot(&plot[i]);
-    }
-
-    clean_internal_socket_plot(&plot[inbound_vectors.last]);
-
-    end = outbound_vectors.last;
-    plot = outbound_vectors.plot;
-    for (i = 0; i < end; i++) {
-        clean_internal_socket_plot(&plot[i]);
-    }
-    clean_internal_socket_plot(&plot[outbound_vectors.last]);
-}
- */
-
-/**
- * Clean network ports allocated during initialization.
+ *  Obsolete charts when systemd is enabled
  *
- * @param ptr a pointer to the link list.
-static void clean_network_ports(ebpf_network_viewer_port_list_t *ptr)
+ *  @param update_every value to overwrite the update frequency set by the server.
+ **/
+static void ebpf_obsolete_systemd_socket_charts(int update_every)
 {
-    if (unlikely(!ptr))
-        return;
-
-    while (ptr) {
-        ebpf_network_viewer_port_list_t *next = ptr->next;
-        freez(ptr->value);
-        freez(ptr);
-        ptr = next;
-    }
+    int order = 20080;
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V4,
+                              "Calls to tcp_v4_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_V4_CONN_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V6,
+                              "Calls to tcp_v6_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_RECV,
+                              "Bytes received",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_BYTES_RECV_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_SENT,
+                              "Bytes sent",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_BYTES_SEND_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RECV_CALLS,
+                              "Calls to tcp_cleanup_rbuf.",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_RECV_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_SEND_CALLS,
+                              "Calls to tcp_sendmsg.",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_SEND_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RETRANSMIT,
+                              "Calls to tcp_retransmit",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_RETRANSMIT_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_SEND_CALLS,
+                              "Calls to udp_sendmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_UDP_SEND_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_RECV_CALLS,
+                              "Calls to udp_recvmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_UDP_RECV_CONTEXT,
+                              order++,
+                              update_every);
 }
- */
 
+static void ebpf_obsolete_specific_socket_charts(char *type, int update_every);
 /**
- * Clean service names
+ * Obsolete cgroup chart
  *
- * Clean the allocated link list that stores names.
+ * Send obsolete for all charts created before to close.
  *
- * @param names the link list.
-static void clean_service_names(ebpf_network_viewer_dim_name_t *names)
-{
-    if (unlikely(!names))
-        return;
-
-    while (names) {
-        ebpf_network_viewer_dim_name_t *next = names->next;
-        freez(names->name);
-        freez(names);
-        names = next;
-    }
-}
+ * @param em a pointer to `struct ebpf_module`
  */
+static inline void ebpf_obsolete_socket_cgroup_charts(ebpf_module_t *em) {
+    pthread_mutex_lock(&mutex_cgroup_shm);
 
-/**
- * Clean hostnames
- *
- * @param hostnames the hostnames to clean
-static void clean_hostnames(ebpf_network_viewer_hostname_list_t *hostnames)
-{
-    if (unlikely(!hostnames))
-        return;
+    ebpf_obsolete_systemd_socket_charts(em->update_every);
+
+    ebpf_cgroup_target_t *ect;
+    for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
+        if (ect->systemd)
+            continue;
 
-    while (hostnames) {
-        ebpf_network_viewer_hostname_list_t *next = hostnames->next;
-        freez(hostnames->value);
-        simple_pattern_free(hostnames->value_pattern);
-        freez(hostnames);
-        hostnames = next;
+        ebpf_obsolete_specific_socket_charts(ect->name, em->update_every);
     }
+    pthread_mutex_unlock(&mutex_cgroup_shm);
 }
- */
 
 /**
- * Clean port Structure
+ * Create apps charts
  *
- * Clean the allocated list.
+ * Call ebpf_create_chart to create the charts on apps submenu.
  *
- * @param clean the list that will be cleaned
+ * @param em   a pointer to the structure with the default values.
  */
-void clean_port_structure(ebpf_network_viewer_port_list_t **clean)
+void ebpf_socket_obsolete_apps_charts(struct ebpf_module *em)
 {
-    ebpf_network_viewer_port_list_t *move = *clean;
-    while (move) {
-        ebpf_network_viewer_port_list_t *next = move->next;
-        freez(move->value);
-        freez(move);
-
-        move = next;
-    }
-    *clean = NULL;
-}
-
-/**
- * Clean IP structure
- *
- * Clean the allocated list.
+    int order = 20080;
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V4,
+                              "Calls to tcp_v4_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V6,
+                              "Calls to tcp_v6_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_SENT,
+                              "Bytes sent",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_RECV,
+                               "bytes received",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_SEND_CALLS,
+                              "Calls for tcp_sendmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RECV_CALLS,
+                              "Calls for tcp_cleanup_rbuf",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RETRANSMIT,
+                              "Calls for tcp_retransmit",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_SEND_CALLS,
+                              "Calls for udp_sendmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_RECV_CALLS,
+                              "Calls for udp_recvmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+}
+
+/**
+ * Obsolete global charts
+ *
+ * Obsolete charts created.
  *
- * @param clean the list that will be cleaned
+ * @param em a pointer to the structure with the default values.
  */
-static void clean_ip_structure(ebpf_network_viewer_ip_list_t **clean)
+static void ebpf_socket_obsolete_global_charts(ebpf_module_t *em)
 {
-    ebpf_network_viewer_ip_list_t *move = *clean;
-    while (move) {
-        ebpf_network_viewer_ip_list_t *next = move->next;
-        freez(move->value);
-        freez(move);
+    int order = 21070;
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_INBOUND_CONNECTIONS,
+                              "Inbound connections.",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_OUTBOUND_CONNECTIONS,
+                              "TCP outbound connections.",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_FUNCTION_COUNT,
+                              "Calls to internal functions",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_FUNCTION_BITS,
+                              "TCP bandwidth",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
 
-        move = next;
+    if (em->mode < MODE_ENTRY) {
+        ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                                  NETDATA_TCP_FUNCTION_ERROR,
+                                  "TCP errors",
+                                  EBPF_COMMON_DIMENSION_CALL,
+                                  NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                                  NETDATA_EBPF_CHART_TYPE_LINE,
+                                  NULL,
+                                  order++,
+                                  em->update_every);
+    }
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_RETRANSMIT,
+                              "Packages retransmitted",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_UDP_FUNCTION_COUNT,
+                              "UDP calls",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_UDP_FUNCTION_BITS,
+                              "UDP bandwidth",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    if (em->mode < MODE_ENTRY) {
+        ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                                  NETDATA_UDP_FUNCTION_ERROR,
+                                  "UDP errors",
+                                  EBPF_COMMON_DIMENSION_CALL,
+                                  NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                                  NETDATA_EBPF_CHART_TYPE_LINE,
+                                  NULL,
+                                  order++,
+                                  em->update_every);
     }
-    *clean = NULL;
-}
 
+    fflush(stdout);
+}
 /**
- * Socket Free
+ * Socket exit
  *
- * Cleanup variables after child threads to stop
+ * Clean up the main thread.
  *
  * @param ptr thread data.
  */
-static void ebpf_socket_free(ebpf_module_t *em )
+static void ebpf_socket_exit(void *ptr)
 {
-    /* We can have thousands of sockets to clean, so we are transferring
-     * for OS the responsibility while we do not use ARAL here
-    freez(socket_hash_values);
+    ebpf_module_t *em = (ebpf_module_t *)ptr;
 
-    freez(bandwidth_vector);
+    if (ebpf_read_socket.thread)
+        netdata_thread_cancel(*ebpf_read_socket.thread);
 
-    freez(socket_values);
-    clean_allocated_socket_plot();
-    freez(inbound_vectors.plot);
-    freez(outbound_vectors.plot);
+    if (em->enabled == NETDATA_THREAD_EBPF_FUNCTION_RUNNING) {
+        pthread_mutex_lock(&lock);
 
-    clean_port_structure(&listen_ports);
+        if (em->cgroup_charts) {
+            ebpf_obsolete_socket_cgroup_charts(em);
+            fflush(stdout);
+        }
 
-    clean_network_ports(network_viewer_opt.included_port);
-    clean_network_ports(network_viewer_opt.excluded_port);
-    clean_service_names(network_viewer_opt.names);
-    clean_hostnames(network_viewer_opt.included_hostnames);
-    clean_hostnames(network_viewer_opt.excluded_hostnames);
-     */
+        if (em->apps_charts & NETDATA_EBPF_APPS_FLAG_CHART_CREATED) {
+            ebpf_socket_obsolete_apps_charts(em);
+            fflush(stdout);
+        }
 
-    pthread_mutex_destroy(&nv_mutex);
+        ebpf_socket_obsolete_global_charts(em);
 
-    pthread_mutex_lock(&ebpf_exit_cleanup);
-    em->enabled = NETDATA_THREAD_EBPF_STOPPED;
-    ebpf_update_stats(&plugin_statistics, em);
-    ebpf_update_kernel_memory_with_vector(&plugin_statistics, em->maps, EBPF_ACTION_STAT_REMOVE);
-    pthread_mutex_unlock(&ebpf_exit_cleanup);
-}
+#ifdef NETDATA_DEV_MODE
+        if (ebpf_aral_socket_pid)
+            ebpf_statistic_obsolete_aral_chart(em, socket_disable_priority);
+#endif
+        pthread_mutex_unlock(&lock);
+    }
 
-/**
- * Socket exit
- *
- * Clean up the main thread.
- *
- * @param ptr thread data.
- */
-static void ebpf_socket_exit(void *ptr)
-{
-    ebpf_module_t *em = (ebpf_module_t *)ptr;
-    pthread_mutex_lock(&nv_mutex);
-    if (socket_threads.thread)
-        netdata_thread_cancel(*socket_threads.thread);
-    pthread_mutex_unlock(&nv_mutex);
     ebpf_socket_free(em);
 }
 
-/**
- * Socket cleanup
- *
- * Clean up allocated addresses.
- *
- * @param ptr thread data.
- */
-void ebpf_socket_cleanup(void *ptr)
-{
-    UNUSED(ptr);
-}
-
 /*****************************************************************
  *
  *  PROCESS DATA AND SEND TO NETDATA
@@ -737,174 +906,6 @@ static void ebpf_update_global_publish(
 }
 
 /**
- * Update Network Viewer plot data
- *
- * @param plot  the structure where the data will be stored
- * @param sock  the last update from the socket
- */
-static inline void update_nv_plot_data(netdata_plot_values_t *plot, netdata_socket_t *sock)
-{
-    if (sock->ct != plot->last_time) {
-        plot->last_time         = sock->ct;
-        plot->plot_recv_packets = sock->recv_packets;
-        plot->plot_sent_packets = sock->sent_packets;
-        plot->plot_recv_bytes   = sock->recv_bytes;
-        plot->plot_sent_bytes   = sock->sent_bytes;
-        plot->plot_retransmit   = sock->retransmit;
-    }
-
-    sock->recv_packets = 0;
-    sock->sent_packets = 0;
-    sock->recv_bytes   = 0;
-    sock->sent_bytes   = 0;
-    sock->retransmit   = 0;
-}
-
-/**
- * Calculate Network Viewer Plot
- *
- * Do math with collected values before to plot data.
- */
-static inline void calculate_nv_plot()
-{
-    pthread_mutex_lock(&nv_mutex);
-    uint32_t i;
-    uint32_t end = inbound_vectors.next;
-    for (i = 0; i < end; i++) {
-        update_nv_plot_data(&inbound_vectors.plot[i].plot, &inbound_vectors.plot[i].sock);
-    }
-    inbound_vectors.max_plot = end;
-
-    // The 'Other' dimension is always calculated for the chart to have at least one dimension
-    update_nv_plot_data(&inbound_vectors.plot[inbound_vectors.last].plot,
-                        &inbound_vectors.plot[inbound_vectors.last].sock);
-
-    end = outbound_vectors.next;
-    for (i = 0; i < end; i++) {
-        update_nv_plot_data(&outbound_vectors.plot[i].plot, &outbound_vectors.plot[i].sock);
-    }
-    outbound_vectors.max_plot = end;
-
-    /*
-    // The 'Other' dimension is always calculated for the chart to have at least one dimension
-    update_nv_plot_data(&outbound_vectors.plot[outbound_vectors.last].plot,
-                        &outbound_vectors.plot[outbound_vectors.last].sock);
-                        */
-    pthread_mutex_unlock(&nv_mutex);
-}
-
-/**
- * Network viewer send bytes
- *
- * @param ptr   the structure with values to plot
- * @param chart the chart name.
- */
-static inline void ebpf_socket_nv_send_bytes(netdata_vector_plot_t *ptr, char *chart)
-{
-    uint32_t i;
-    uint32_t end = ptr->last_plot;
-    netdata_socket_plot_t *w = ptr->plot;
-    collected_number value;
-
-    write_begin_chart(NETDATA_EBPF_FAMILY, chart);
-    for (i = 0; i < end; i++) {
-        value = ((collected_number) w[i].plot.plot_sent_bytes);
-        write_chart_dimension(w[i].dimension_sent, value);
-        value = (collected_number) w[i].plot.plot_recv_bytes;
-        write_chart_dimension(w[i].dimension_recv, value);
-    }
-
-    i = ptr->last;
-    value = ((collected_number) w[i].plot.plot_sent_bytes);
-    write_chart_dimension(w[i].dimension_sent, value);
-    value = (collected_number) w[i].plot.plot_recv_bytes;
-    write_chart_dimension(w[i].dimension_recv, value);
-    write_end_chart();
-}
-
-/**
- * Network Viewer Send packets
- *
- * @param ptr   the structure with values to plot
- * @param chart the chart name.
- */
-static inline void ebpf_socket_nv_send_packets(netdata_vector_plot_t *ptr, char *chart)
-{
-    uint32_t i;
-    uint32_t end = ptr->last_plot;
-    netdata_socket_plot_t *w = ptr->plot;
-    collected_number value;
-
-    write_begin_chart(NETDATA_EBPF_FAMILY, chart);
-    for (i = 0; i < end; i++) {
-        value = ((collected_number)w[i].plot.plot_sent_packets);
-        write_chart_dimension(w[i].dimension_sent, value);
-        value = (collected_number) w[i].plot.plot_recv_packets;
-        write_chart_dimension(w[i].dimension_recv, value);
-    }
-
-    i = ptr->last;
-    value = ((collected_number)w[i].plot.plot_sent_packets);
-    write_chart_dimension(w[i].dimension_sent, value);
-    value = (collected_number)w[i].plot.plot_recv_packets;
-    write_chart_dimension(w[i].dimension_recv, value);
-    write_end_chart();
-}
-
-/**
- * Network Viewer Send Retransmit
- *
- * @param ptr   the structure with values to plot
- * @param chart the chart name.
- */
-static inline void ebpf_socket_nv_send_retransmit(netdata_vector_plot_t *ptr, char *chart)
-{
-    uint32_t i;
-    uint32_t end = ptr->last_plot;
-    netdata_socket_plot_t *w = ptr->plot;
-    collected_number value;
-
-    write_begin_chart(NETDATA_EBPF_FAMILY, chart);
-    for (i = 0; i < end; i++) {
-        value = (collected_number) w[i].plot.plot_retransmit;
-        write_chart_dimension(w[i].dimension_retransmit, value);
-    }
-
-    i = ptr->last;
-    value = (collected_number)w[i].plot.plot_retransmit;
-    write_chart_dimension(w[i].dimension_retransmit, value);
-    write_end_chart();
-}
-
-/**
- * Send network viewer data
- *
- * @param ptr the pointer to plot data
- */
-static void ebpf_socket_send_nv_data(netdata_vector_plot_t *ptr)
-{
-    if (!ptr->flags)
-        return;
-
-    if (ptr == (netdata_vector_plot_t *)&outbound_vectors) {
-        ebpf_socket_nv_send_bytes(ptr, NETDATA_NV_OUTBOUND_BYTES);
-        fflush(stdout);
-
-        ebpf_socket_nv_send_packets(ptr, NETDATA_NV_OUTBOUND_PACKETS);
-        fflush(stdout);
-
-        ebpf_socket_nv_send_retransmit(ptr,  NETDATA_NV_OUTBOUND_RETRANSMIT);
-        fflush(stdout);
-    } else {
-        ebpf_socket_nv_send_bytes(ptr, NETDATA_NV_INBOUND_BYTES);
-        fflush(stdout);
-
-        ebpf_socket_nv_send_packets(ptr, NETDATA_NV_INBOUND_PACKETS);
-        fflush(stdout);
-    }
-}
-
-/**
  * Send Global Inbound connection
  *
  * Send number of connections read per protocol.
@@ -1112,7 +1113,7 @@ void ebpf_socket_send_apps_data(ebpf_module_t *em, struct ebpf_target *root)
  *
  * @param em a pointer to the structure with the default values.
  */
-static void ebpf_create_global_charts(ebpf_module_t *em)
+static void ebpf_socket_create_global_charts(ebpf_module_t *em)
 {
     int order = 21070;
     ebpf_create_chart(NETDATA_EBPF_IP_FAMILY,
@@ -1319,138 +1320,6 @@ void ebpf_socket_create_apps_charts(struct ebpf_module *em, void *ptr)
     em->apps_charts |= NETDATA_EBPF_APPS_FLAG_CHART_CREATED;
 }
 
-/**
- *  Create network viewer chart
- *
- *  Create common charts.
- *
- * @param id            chart id
- * @param title         chart title
- * @param units         units label
- * @param family        group name used to attach the chart on dashboard
- * @param order         chart order
- * @param update_every value to overwrite the update frequency set by the server.
- * @param ptr          plot structure with values.
- */
-static void ebpf_socket_create_nv_chart(char *id, char *title, char *units,
-                                        char *family, int order, int update_every, netdata_vector_plot_t *ptr)
-{
-    ebpf_write_chart_cmd(NETDATA_EBPF_FAMILY,
-                         id,
-                         title,
-                         units,
-                         family,
-                         NETDATA_EBPF_CHART_TYPE_STACKED,
-                         NULL,
-                         order,
-                         update_every,
-                         NETDATA_EBPF_MODULE_NAME_SOCKET);
-
-    uint32_t i;
-    uint32_t end = ptr->last_plot;
-    netdata_socket_plot_t *w = ptr->plot;
-    for (i = 0; i < end; i++) {
-        fprintf(stdout, "DIMENSION %s '' incremental -1 1\n", w[i].dimension_sent);
-        fprintf(stdout, "DIMENSION %s '' incremental 1 1\n", w[i].dimension_recv);
-    }
-
-    end = ptr->last;
-    fprintf(stdout, "DIMENSION %s '' incremental -1 1\n", w[end].dimension_sent);
-    fprintf(stdout, "DIMENSION %s '' incremental 1 1\n", w[end].dimension_recv);
-}
-
-/**
- *  Create network viewer retransmit
- *
- *  Create a specific chart.
- *
- * @param id        the chart id
- * @param title     the chart title
- * @param units     the units label
- * @param family    the group name used to attach the chart on dashboard
- * @param order     the chart order
- * @param update_every value to overwrite the update frequency set by the server.
- * @param ptr       the plot structure with values.
- */
-static void ebpf_socket_create_nv_retransmit(char *id, char *title, char *units,
-                                             char *family, int order, int update_every, netdata_vector_plot_t *ptr)
-{
-    ebpf_write_chart_cmd(NETDATA_EBPF_FAMILY,
-                         id,
-                         title,
-                         units,
-                         family,
-                         NETDATA_EBPF_CHART_TYPE_STACKED,
-                         NULL,
-                         order,
-                         update_every,
-                         NETDATA_EBPF_MODULE_NAME_SOCKET);
-
-    uint32_t i;
-    uint32_t end = ptr->last_plot;
-    netdata_socket_plot_t *w = ptr->plot;
-    for (i = 0; i < end; i++) {
-        fprintf(stdout, "DIMENSION %s '' incremental 1 1\n", w[i].dimension_retransmit);
-    }
-
-    end = ptr->last;
-    fprintf(stdout, "DIMENSION %s '' incremental 1 1\n", w[end].dimension_retransmit);
-}
-
-/**
- * Create Network Viewer charts
- *
- * Recreate the charts when new sockets are created.
- *
- * @param ptr a pointer for inbound or outbound vectors.
- * @param update_every value to overwrite the update frequency set by the server.
- */
-static void ebpf_socket_create_nv_charts(netdata_vector_plot_t *ptr, int update_every)
-{
-    // We do not have new sockets, so we do not need move forward
-    if (ptr->max_plot == ptr->last_plot)
-        return;
-
-    ptr->last_plot = ptr->max_plot;
-
-    if (ptr == (netdata_vector_plot_t *)&outbound_vectors) {
-        ebpf_socket_create_nv_chart(NETDATA_NV_OUTBOUND_BYTES,
-                                    "Outbound connections (bytes).", EBPF_COMMON_DIMENSION_BYTES,
-                                    NETDATA_NETWORK_CONNECTIONS_GROUP,
-                                    21080,
-                                    update_every, ptr);
-
-        ebpf_socket_create_nv_chart(NETDATA_NV_OUTBOUND_PACKETS,
-                                    "Outbound connections (packets)",
-                                    EBPF_COMMON_DIMENSION_PACKETS,
-                                    NETDATA_NETWORK_CONNECTIONS_GROUP,
-                                    21082,
-                                    update_every, ptr);
-
-        ebpf_socket_create_nv_retransmit(NETDATA_NV_OUTBOUND_RETRANSMIT,
-                                         "Retransmitted packets",
-                                         EBPF_COMMON_DIMENSION_CALL,
-                                         NETDATA_NETWORK_CONNECTIONS_GROUP,
-                                         21083,
-                                         update_every, ptr);
-    } else {
-        ebpf_socket_create_nv_chart(NETDATA_NV_INBOUND_BYTES,
-                                    "Inbound connections (bytes)", EBPF_COMMON_DIMENSION_BYTES,
-                                    NETDATA_NETWORK_CONNECTIONS_GROUP,
-                                    21084,
-                                    update_every, ptr);
-
-        ebpf_socket_create_nv_chart(NETDATA_NV_INBOUND_PACKETS,
-                                    "Inbound connections (packets)",
-                                    EBPF_COMMON_DIMENSION_PACKETS,
-                                    NETDATA_NETWORK_CONNECTIONS_GROUP,
-                                    21085,
-                                    update_every, ptr);
-    }
-
-    ptr->flags |= NETWORK_VIEWER_CHARTS_CREATED;
-}
-
 /*****************************************************************
  *
  *  READ INFORMATION FROM KERNEL RING
@@ -1517,7 +1386,7 @@ static int ebpf_is_specific_ip_inside_range(union netdata_ip_t *cmp, int family)
  *
  * @return It returns 1 when cmp is inside and 0 otherwise.
  */
-static int is_port_inside_range(uint16_t cmp)
+static int ebpf_is_port_inside_range(uint16_t cmp)
 {
     // We do not have restrictions for ports.
     if (!network_viewer_opt.excluded_port && !network_viewer_opt.included_port)
@@ -1525,7 +1394,6 @@ static int is_port_inside_range(uint16_t cmp)
 
     // Test if port is excluded
     ebpf_network_viewer_port_list_t *move = network_viewer_opt.excluded_port;
-    cmp = htons(cmp);
     while (move) {
         if (move->cmp_first <= cmp && cmp <= move->cmp_last)
             return 0;
@@ -1583,493 +1451,322 @@ int hostname_matches_pattern(char *cmp)
  * Compare destination addresses and destination ports to define next steps
  *
  * @param key     the socket read from kernel ring
- * @param family  the family used to compare IPs (AF_INET and AF_INET6)
+ * @param data    the socket data used also used to refuse some sockets.
  *
  * @return It returns 1 if this socket is inside the ranges and 0 otherwise.
  */
-int is_socket_allowed(netdata_socket_idx_t *key, int family)
+int ebpf_is_socket_allowed(netdata_socket_idx_t *key, netdata_socket_t *data)
 {
-    if (!is_port_inside_range(key->dport))
-        return 0;
-
-    return ebpf_is_specific_ip_inside_range(&key->daddr, family);
-}
-
-/**
- * Compare sockets
- *
- * Compare destination address and destination port.
- * We do not compare source port, because it is random.
- * We also do not compare source address, because inbound and outbound connections are stored in separated AVL trees.
- *
- * @param a pointer to netdata_socket_plot
- * @param b pointer  to netdata_socket_plot
- *
- * @return It returns 0 case the values are equal, 1 case a is bigger than b and -1 case a is smaller than b.
- */
-static int ebpf_compare_sockets(void *a, void *b)
-{
-    struct netdata_socket_plot *val1 = a;
-    struct netdata_socket_plot *val2 = b;
-    int cmp = 0;
+    int ret = 0;
+    // If family is not AF_UNSPEC and it is different of specified
+    if (network_viewer_opt.family && network_viewer_opt.family != data->family)
+        goto endsocketallowed;
 
-    // We do not need to compare val2 family, because data inside hash table is always from the same family
-    if (val1->family == AF_INET) { //IPV4
-        if (network_viewer_opt.included_port || network_viewer_opt.excluded_port)
-            cmp = memcmp(&val1->index.dport, &val2->index.dport, sizeof(uint16_t));
+    if (!ebpf_is_port_inside_range(key->dport))
+        goto endsocketallowed;
 
-        if (!cmp) {
-            cmp = memcmp(&val1->index.daddr.addr32[0], &val2->index.daddr.addr32[0], sizeof(uint32_t));
-        }
-    } else {
-        if (network_viewer_opt.included_port || network_viewer_opt.excluded_port)
-            cmp = memcmp(&val1->index.dport, &val2->index.dport, sizeof(uint16_t));
+    ret = ebpf_is_specific_ip_inside_range(&key->daddr, data->family);
 
-        if (!cmp) {
-            cmp = memcmp(&val1->index.daddr.addr32, &val2->index.daddr.addr32, 4*sizeof(uint32_t));
-        }
-    }
-
-    return cmp;
+endsocketallowed:
+    return ret;
 }
 
 /**
- * Build dimension name
- *
- * Fill dimension name vector with values given
- *
- * @param dimname       the output vector
- * @param hostname      the hostname for the socket.
- * @param service_name  the service used to connect.
- * @param proto         the protocol used in this connection
- * @param family        is this IPV4(AF_INET) or IPV6(AF_INET6)
+ * Hash accumulator
  *
- * @return  it returns the size of the data copied on success and -1 otherwise.
+ * @param values        the values used to calculate the data.
+ * @param family        the connection family
+ * @param end           the values size.
  */
-static inline int ebpf_build_outbound_dimension_name(char *dimname, char *hostname, char *service_name,
-                                                     char *proto, int family)
+static void ebpf_hash_socket_accumulator(netdata_socket_t *values, int end)
 {
-    if (network_viewer_opt.included_port || network_viewer_opt.excluded_port)
-        return snprintf(dimname, CONFIG_MAX_NAME - 7, (family == AF_INET)?"%s:%s:%s_":"%s:%s:[%s]_",
-                        service_name, proto, hostname);
+    int i;
+    uint8_t protocol = values[0].protocol;
+    uint64_t ct = values[0].current_timestamp;
+    uint64_t ft = values[0].first_timestamp;
+    uint16_t family = AF_UNSPEC;
+    uint32_t external_origin = values[0].external_origin;
+    for (i = 1; i < end; i++) {
+        netdata_socket_t *w = &values[i];
 
-    return snprintf(dimname, CONFIG_MAX_NAME - 7, (family == AF_INET)?"%s:%s_":"%s:[%s]_",
-                    proto, hostname);
-}
+        values[0].tcp.call_tcp_sent         += w->tcp.call_tcp_sent;
+        values[0].tcp.call_tcp_received     += w->tcp.call_tcp_received;
+        values[0].tcp.tcp_bytes_received    += w->tcp.tcp_bytes_received;
+        values[0].tcp.tcp_bytes_sent        += w->tcp.tcp_bytes_sent;
+        values[0].tcp.close                 += w->tcp.close;
+        values[0].tcp.retransmit            += w->tcp.retransmit;
+        values[0].tcp.ipv4_connect          += w->tcp.ipv4_connect;
+        values[0].tcp.ipv6_connect          += w->tcp.ipv6_connect;
 
-/**
- * Fill inbound dimension name
- *
- * Mount the dimension name with the input given
- *
- * @param dimname       the output vector
- * @param service_name  the service used to connect.
- * @param proto         the protocol used in this connection
- *
- * @return  it returns the size of the data copied on success and -1 otherwise.
- */
-static inline int build_inbound_dimension_name(char *dimname, char *service_name, char *proto)
-{
-    return snprintf(dimname, CONFIG_MAX_NAME - 7, "%s:%s_", service_name,
-                    proto);
-}
-
-/**
- * Fill Resolved Name
- *
- * Fill the resolved name structure with the value given.
- * The hostname is the largest value possible, if it is necessary to cut some value, it must be cut.
- *
- * @param ptr          the output vector
- * @param hostname     the hostname resolved or IP.
- * @param length       the length for the hostname.
- * @param service_name the service name associated to the connection
- * @param is_outbound    the is this an outbound connection
- */
-static inline void fill_resolved_name(netdata_socket_plot_t *ptr, char *hostname, size_t length,
-                                      char *service_name, int is_outbound)
-{
-    if (length < NETDATA_MAX_NETWORK_COMBINED_LENGTH)
-        ptr->resolved_name = strdupz(hostname);
-    else {
-        length = NETDATA_MAX_NETWORK_COMBINED_LENGTH;
-        ptr->resolved_name = mallocz( NETDATA_MAX_NETWORK_COMBINED_LENGTH + 1);
-        memcpy(ptr->resolved_name, hostname, length);
-        ptr->resolved_name[length] = '\0';
-    }
-
-    char dimname[CONFIG_MAX_NAME];
-    int size;
-    char *protocol;
-    if (ptr->sock.protocol == IPPROTO_UDP) {
-        protocol = "UDP";
-    } else if (ptr->sock.protocol == IPPROTO_TCP) {
-        protocol = "TCP";
-    } else {
-        protocol = "ALL";
-    }
+        if (!protocol)
+            protocol = w->protocol;
 
-    if (is_outbound)
-        size = ebpf_build_outbound_dimension_name(dimname, hostname, service_name, protocol, ptr->family);
-    else
-        size = build_inbound_dimension_name(dimname,service_name, protocol);
+        if (family == AF_UNSPEC)
+            family = w->family;
 
-    if (size > 0) {
-        strcpy(&dimname[size], "sent");
-        dimname[size + 4] = '\0';
-        ptr->dimension_sent = strdupz(dimname);
+        if (w->current_timestamp > ct)
+            ct = w->current_timestamp;
 
-        strcpy(&dimname[size], "recv");
-        ptr->dimension_recv = strdupz(dimname);
+        if (!ft)
+            ft = w->first_timestamp;
 
-        dimname[size - 1] = '\0';
-        ptr->dimension_retransmit = strdupz(dimname);
+        if (w->external_origin)
+            external_origin = NETDATA_EBPF_SRC_IP_ORIGIN_EXTERNAL;
     }
+
+    values[0].protocol          = (!protocol)?IPPROTO_TCP:protocol;
+    values[0].current_timestamp = ct;
+    values[0].first_timestamp = ft;
+    values[0].external_origin = external_origin;
 }
 
 /**
- * Mount dimension names
- *
- * Fill the vector names after to resolve the addresses
+ * Translate socket
  *
- * @param ptr a pointer to the structure where the values are stored.
- * @param is_outbound is a outbound ptr value?
+ * Convert socket address to string
  *
- * @return It returns 1 if the name is valid and 0 otherwise.
+ * @param dst structure where we will store
+ * @param key the socket address
  */
-int fill_names(netdata_socket_plot_t *ptr, int is_outbound)
+static void ebpf_socket_translate(netdata_socket_plus_t *dst, netdata_socket_idx_t *key)
 {
-    char hostname[NI_MAXHOST], service_name[NI_MAXSERV];
-    if (ptr->resolved)
-        return 1;
-
+    uint32_t resolve = network_viewer_opt.service_resolution_enabled;
+    char service[NI_MAXSERV];
     int ret;
-    static int resolve_name = -1;
-    static int resolve_service = -1;
-    if (resolve_name == -1)
-        resolve_name = network_viewer_opt.hostname_resolution_enabled;
-
-    if (resolve_service == -1)
-        resolve_service = network_viewer_opt.service_resolution_enabled;
-
-    netdata_socket_idx_t *idx = &ptr->index;
-
-    char *errname = { "Not resolved" };
-    // Resolve Name
-    if (ptr->family == AF_INET) { //IPV4
-        struct sockaddr_in myaddr;
-        memset(&myaddr, 0 , sizeof(myaddr));
-
-        myaddr.sin_family = ptr->family;
-        if (is_outbound) {
-            myaddr.sin_port = idx->dport;
-            myaddr.sin_addr.s_addr = idx->daddr.addr32[0];
-        } else {
-            myaddr.sin_port = idx->sport;
-            myaddr.sin_addr.s_addr = idx->saddr.addr32[0];
-        }
-
-        ret = (!resolve_name)?-1:getnameinfo((struct sockaddr *)&myaddr, sizeof(myaddr), hostname,
-                                              sizeof(hostname), service_name, sizeof(service_name), NI_NAMEREQD);
-
-        if (!ret && !resolve_service) {
-            snprintf(service_name, sizeof(service_name), "%u", ntohs(myaddr.sin_port));
+    if (dst->data.family == AF_INET) {
+        struct sockaddr_in ipv4_addr = { };
+        ipv4_addr.sin_port = 0;
+        ipv4_addr.sin_addr.s_addr = key->saddr.addr32[0];
+        ipv4_addr.sin_family = AF_INET;
+        if (resolve) {
+            // NI_NAMEREQD : It is too slow
+            ret = getnameinfo((struct sockaddr *) &ipv4_addr, sizeof(ipv4_addr), dst->socket_string.src_ip,
+                              INET6_ADDRSTRLEN, service, NI_MAXSERV, NI_NUMERICHOST | NI_NUMERICSERV);
+            if (ret) {
+                collector_error("Cannot resolve name: %s", gai_strerror(ret));
+                resolve = 0;
+            } else {
+                ipv4_addr.sin_addr.s_addr = key->daddr.addr32[0];
+
+                ipv4_addr.sin_port = key->dport;
+                ret = getnameinfo((struct sockaddr *) &ipv4_addr, sizeof(ipv4_addr), dst->socket_string.dst_ip,
+                                  INET6_ADDRSTRLEN, dst->socket_string.dst_port, NI_MAXSERV,
+                                  NI_NUMERICHOST);
+                if (ret) {
+                    collector_error("Cannot resolve name: %s", gai_strerror(ret));
+                    resolve = 0;
+                }
+            }
         }
 
-        if (ret) {
-            // I cannot resolve the name, I will use the IP
-            if (!inet_ntop(AF_INET, &myaddr.sin_addr.s_addr, hostname, NI_MAXHOST)) {
-                strncpy(hostname, errname, 13);
-            }
+        // When resolution fail, we should use addresses
+        if (!resolve) {
+            ipv4_addr.sin_addr.s_addr = key->saddr.addr32[0];
 
-            snprintf(service_name, sizeof(service_name), "%u", ntohs(myaddr.sin_port));
-            ret = 1;
-        }
-    } else { // IPV6
-        struct sockaddr_in6 myaddr6;
-        memset(&myaddr6, 0 , sizeof(myaddr6));
-
-        myaddr6.sin6_family = AF_INET6;
-        if (is_outbound) {
-            myaddr6.sin6_port =  idx->dport;
-            memcpy(myaddr6.sin6_addr.s6_addr, idx->daddr.addr8, sizeof(union netdata_ip_t));
-        } else {
-            myaddr6.sin6_port =  idx->sport;
-            memcpy(myaddr6.sin6_addr.s6_addr, idx->saddr.addr8, sizeof(union netdata_ip_t));
-        }
+            if(!inet_ntop(AF_INET, &ipv4_addr.sin_addr, dst->socket_string.src_ip, INET6_ADDRSTRLEN))
+                netdata_log_info("Cannot convert IP %u .", ipv4_addr.sin_addr.s_addr);
 
-        ret = (!resolve_name)?-1:getnameinfo((struct sockaddr *)&myaddr6, sizeof(myaddr6), hostname,
-                                              sizeof(hostname), service_name, sizeof(service_name), NI_NAMEREQD);
+            ipv4_addr.sin_addr.s_addr = key->daddr.addr32[0];
 
-        if (!ret && !resolve_service) {
-            snprintf(service_name, sizeof(service_name), "%u", ntohs(myaddr6.sin6_port));
+            if(!inet_ntop(AF_INET, &ipv4_addr.sin_addr, dst->socket_string.dst_ip, INET6_ADDRSTRLEN))
+                netdata_log_info("Cannot convert IP %u .", ipv4_addr.sin_addr.s_addr);
+            snprintfz(dst->socket_string.dst_port, NI_MAXSERV, "%u",  ntohs(key->dport));
         }
-
-        if (ret) {
-            // I cannot resolve the name, I will use the IP
-            if (!inet_ntop(AF_INET6, myaddr6.sin6_addr.s6_addr, hostname, NI_MAXHOST)) {
-                strncpy(hostname, errname, 13);
+    } else {
+        struct sockaddr_in6 ipv6_addr = { };
+        memcpy(&ipv6_addr.sin6_addr, key->saddr.addr8, sizeof(key->saddr.addr8));
+        ipv6_addr.sin6_family = AF_INET6;
+        if (resolve) {
+            ret = getnameinfo((struct sockaddr *) &ipv6_addr, sizeof(ipv6_addr), dst->socket_string.src_ip,
+                              INET6_ADDRSTRLEN, service, NI_MAXSERV, NI_NUMERICHOST | NI_NUMERICSERV);
+            if (ret) {
+                collector_error("Cannot resolve name: %s", gai_strerror(ret));
+                resolve = 0;
+            } else {
+                memcpy(&ipv6_addr.sin6_addr, key->daddr.addr8, sizeof(key->daddr.addr8));
+                ret = getnameinfo((struct sockaddr *) &ipv6_addr, sizeof(ipv6_addr), dst->socket_string.dst_ip,
+                                  INET6_ADDRSTRLEN, dst->socket_string.dst_port, NI_MAXSERV,
+                                  NI_NUMERICHOST);
+                if (ret) {
+                    collector_error("Cannot resolve name: %s", gai_strerror(ret));
+                    resolve = 0;
+                }
             }
+        }
 
-            snprintf(service_name, sizeof(service_name), "%u", ntohs(myaddr6.sin6_port));
+        if (!resolve) {
+            memcpy(&ipv6_addr.sin6_addr, key->saddr.addr8, sizeof(key->saddr.addr8));
+            if(!inet_ntop(AF_INET6, &ipv6_addr.sin6_addr, dst->socket_string.src_ip, INET6_ADDRSTRLEN))
+                netdata_log_info("Cannot convert IPv6 Address.");
 
-            ret = 1;
+            memcpy(&ipv6_addr.sin6_addr, key->daddr.addr8, sizeof(key->daddr.addr8));
+            if(!inet_ntop(AF_INET6, &ipv6_addr.sin6_addr, dst->socket_string.dst_ip, INET6_ADDRSTRLEN))
+                netdata_log_info("Cannot convert IPv6 Address.");
+            snprintfz(dst->socket_string.dst_port, NI_MAXSERV, "%u",  ntohs(key->dport));
         }
     }
+    dst->pid = key->pid;
 
-    fill_resolved_name(ptr, hostname,
-                       strlen(hostname) + strlen(service_name)+ NETDATA_DOTS_PROTOCOL_COMBINED_LENGTH,
-                       service_name, is_outbound);
-
-    if (resolve_name && !ret)
-        ret = hostname_matches_pattern(hostname);
-
-    ptr->resolved++;
-
-    return ret;
-}
-
-/**
- * Fill last Network Viewer Dimension
- *
- * Fill the unique dimension that is always plotted.
- *
- * @param ptr           the pointer for the last dimension
- * @param is_outbound    is this an inbound structure?
- */
-static void fill_last_nv_dimension(netdata_socket_plot_t *ptr, int is_outbound)
-{
-    char hostname[NI_MAXHOST], service_name[NI_MAXSERV];
-    char *other = { "other" };
-    // We are also copying the NULL bytes to avoid warnings in new compilers
-    strncpy(hostname, other, 6);
-    strncpy(service_name, other, 6);
-
-    ptr->family = AF_INET;
-    ptr->sock.protocol = 255;
-    ptr->flags = (!is_outbound)?NETDATA_INBOUND_DIRECTION:NETDATA_OUTBOUND_DIRECTION;
-
-    fill_resolved_name(ptr, hostname,  10 + NETDATA_DOTS_PROTOCOL_COMBINED_LENGTH, service_name, is_outbound);
-
-#ifdef NETDATA_INTERNAL_CHECKS
-    netdata_log_info("Last %s dimension added: ID = %u, IP = OTHER, NAME = %s, DIM1 = %s, DIM2 = %s, DIM3 = %s",
-         (is_outbound)?"outbound":"inbound", network_viewer_opt.max_dim - 1, ptr->resolved_name,
-         ptr->dimension_recv, ptr->dimension_sent, ptr->dimension_retransmit);
+    if (!strcmp(dst->socket_string.dst_port, "0"))
+        snprintfz(dst->socket_string.dst_port, NI_MAXSERV, "%u",  ntohs(key->dport));
+#ifdef NETDATA_DEV_MODE
+    collector_info("New socket: { ORIGIN IP: %s, ORIGIN : %u, DST IP:%s, DST PORT: %s, PID: %u, PROTO: %d, FAMILY: %d}",
+                   dst->socket_string.src_ip,
+                   dst->data.external_origin,
+                   dst->socket_string.dst_ip,
+                   dst->socket_string.dst_port,
+                   dst->pid,
+                   dst->data.protocol,
+                   dst->data.family
+                   );
 #endif
 }
 
 /**
- * Update Socket Data
+ * Update array vectors
  *
- * Update the socket information with last collected data
+ * Read data from hash table and update vectors.
  *
- * @param sock
- * @param lvalues
+ * @param em the structure with configuration
  */
-static inline void update_socket_data(netdata_socket_t *sock, netdata_socket_t *lvalues)
+static void ebpf_update_array_vectors(ebpf_module_t *em)
 {
-    sock->recv_packets = lvalues->recv_packets;
-    sock->sent_packets = lvalues->sent_packets;
-    sock->recv_bytes   = lvalues->recv_bytes;
-    sock->sent_bytes   = lvalues->sent_bytes;
-    sock->retransmit   = lvalues->retransmit;
-    sock->ct = lvalues->ct;
-}
+    netdata_thread_disable_cancelability();
+    netdata_socket_idx_t key = {};
+    netdata_socket_idx_t next_key = {};
 
-/**
- * Store socket inside avl
- *
- * Store the socket values inside the avl tree.
- *
- * @param out     the structure with information used to plot charts.
- * @param lvalues Values read from socket ring.
- * @param lindex  the index information, the real socket.
- * @param family  the family associated to the socket
- * @param flags   the connection flags
- */
-static void store_socket_inside_avl(netdata_vector_plot_t *out, netdata_socket_t *lvalues,
-                                    netdata_socket_idx_t *lindex, int family, uint32_t flags)
-{
-    netdata_socket_plot_t test, *ret ;
+    int maps_per_core = em->maps_per_core;
+    int fd = em->maps[NETDATA_SOCKET_OPEN_SOCKET].map_fd;
 
-    memcpy(&test.index, lindex, sizeof(netdata_socket_idx_t));
-    test.flags = flags;
+    netdata_socket_t *values = socket_values;
+    size_t length = sizeof(netdata_socket_t);
+    int test, end;
+    if (maps_per_core) {
+        length *= ebpf_nprocs;
+        end = ebpf_nprocs;
+    } else
+        end = 1;
 
-    ret = (netdata_socket_plot_t *) avl_search_lock(&out->tree, (avl_t *)&test);
-    if (ret) {
-        if (lvalues->ct != ret->plot.last_time) {
-            update_socket_data(&ret->sock, lvalues);
+    // We need to reset the values when we are working on kernel 4.15 or newer, because kernel does not create
+    // values for specific processor unless it is used to store data. As result of this behavior one the next socket
+    // can have values from the previous one.
+    memset(values, 0, length);
+    time_t update_time = time(NULL);
+    while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
+        test = bpf_map_lookup_elem(fd, &key, values);
+        if (test < 0) {
+            goto end_socket_loop;
         }
-    } else {
-        uint32_t curr = out->next;
-        uint32_t last = out->last;
-
-        netdata_socket_plot_t *w = &out->plot[curr];
-
-        int resolved;
-        if (curr == last) {
-            if (lvalues->ct != w->plot.last_time) {
-                update_socket_data(&w->sock, lvalues);
-            }
-            return;
-        } else {
-            memcpy(&w->sock, lvalues, sizeof(netdata_socket_t));
-            memcpy(&w->index, lindex, sizeof(netdata_socket_idx_t));
-            w->family = family;
 
-            resolved = fill_names(w, out != (netdata_vector_plot_t *)&inbound_vectors);
+        if (key.pid > (uint32_t)pid_max) {
+            goto end_socket_loop;
         }
 
-        if (!resolved) {
-            freez(w->resolved_name);
-            freez(w->dimension_sent);
-            freez(w->dimension_recv);
-            freez(w->dimension_retransmit);
-
-            memset(w, 0, sizeof(netdata_socket_plot_t));
+        ebpf_hash_socket_accumulator(values, end);
+        ebpf_socket_fill_publish_apps(key.pid, values);
 
-            return;
+        // We update UDP to show info with charts, but we do not show them with functions
+        /*
+        if (key.dport == NETDATA_EBPF_UDP_PORT && values[0].protocol == IPPROTO_UDP) {
+            bpf_map_delete_elem(fd, &key);
+            goto end_socket_loop;
         }
+         */
 
-        w->flags = flags;
-        netdata_socket_plot_t *check ;
-        check = (netdata_socket_plot_t *) avl_insert_lock(&out->tree, (avl_t *)w);
-        if (check != w)
-            netdata_log_error("Internal error, cannot insert the AVL tree.");
-
-#ifdef NETDATA_INTERNAL_CHECKS
-        char iptext[INET6_ADDRSTRLEN];
-        if (inet_ntop(family, &w->index.daddr.addr8, iptext, sizeof(iptext)))
-            netdata_log_info("New %s dimension added: ID = %u, IP = %s, NAME = %s, DIM1 = %s, DIM2 = %s, DIM3 = %s",
-                 (out == &inbound_vectors)?"inbound":"outbound", curr, iptext, w->resolved_name,
-                 w->dimension_recv, w->dimension_sent, w->dimension_retransmit);
-#endif
-        curr++;
-        if (curr > last)
-            curr = last;
-        out->next = curr;
-    }
-}
-
-/**
- * Compare Vector to store
- *
- * Compare input values with local address to select table to store.
- *
- * @param direction  store inbound and outbound direction.
- * @param cmp        index read from hash table.
- * @param proto      the protocol read.
- *
- * @return It returns the structure with address to compare.
- */
-netdata_vector_plot_t * select_vector_to_store(uint32_t *direction, netdata_socket_idx_t *cmp, uint8_t proto)
-{
-    if (!listen_ports) {
-        *direction = NETDATA_OUTBOUND_DIRECTION;
-        return &outbound_vectors;
-    }
+        // Discard non-bind sockets
+        if (!key.daddr.addr64[0] && !key.daddr.addr64[1] && !key.saddr.addr64[0] && !key.saddr.addr64[1]) {
+            bpf_map_delete_elem(fd, &key);
+            goto end_socket_loop;
+        }
 
-    ebpf_network_viewer_port_list_t *move_ports = listen_ports;
-    while (move_ports) {
-        if (move_ports->protocol == proto && move_ports->first == cmp->sport) {
-            *direction = NETDATA_INBOUND_DIRECTION;
-            return &inbound_vectors;
+        // When socket is not allowed, we do not append it to table, but we are still keeping it to accumulate data.
+        if (!ebpf_is_socket_allowed(&key, values)) {
+            goto end_socket_loop;
         }
 
-        move_ports = move_ports->next;
-    }
+        // Get PID structure
+        rw_spinlock_write_lock(&ebpf_judy_pid.index.rw_spinlock);
+        PPvoid_t judy_array = &ebpf_judy_pid.index.JudyLArray;
+        netdata_ebpf_judy_pid_stats_t *pid_ptr = ebpf_get_pid_from_judy_unsafe(judy_array, key.pid);
+        if (!pid_ptr) {
+            goto end_socket_loop;
+        }
 
-    *direction = NETDATA_OUTBOUND_DIRECTION;
-    return &outbound_vectors;
-}
+        // Get Socket structure
+        rw_spinlock_write_lock(&pid_ptr->socket_stats.rw_spinlock);
+        netdata_socket_plus_t **socket_pptr = (netdata_socket_plus_t **)ebpf_judy_insert_unsafe(
+            &pid_ptr->socket_stats.JudyLArray, values[0].first_timestamp);
+        netdata_socket_plus_t *socket_ptr = *socket_pptr;
+        bool translate = false;
+        if (likely(*socket_pptr == NULL)) {
+            *socket_pptr = aral_mallocz(aral_socket_table);
 
-/**
- * Hash accumulator
- *
- * @param values        the values used to calculate the data.
- * @param key           the key to store  data.
- * @param family        the connection family
- * @param end           the values size.
- */
-static void hash_accumulator(netdata_socket_t *values, netdata_socket_idx_t *key, int family, int end)
-{
-    if (!network_viewer_opt.enabled || !is_socket_allowed(key, family))
-        return;
+            socket_ptr = *socket_pptr;
 
-    uint64_t bsent = 0, brecv = 0, psent = 0, precv = 0;
-    uint16_t retransmit = 0;
-    int i;
-    uint8_t protocol = values[0].protocol;
-    uint64_t ct = values[0].ct;
-    for (i = 1; i < end; i++) {
-        netdata_socket_t *w = &values[i];
-
-        precv += w->recv_packets;
-        psent += w->sent_packets;
-        brecv += w->recv_bytes;
-        bsent += w->sent_bytes;
-        retransmit += w->retransmit;
+            translate = true;
+        }
+        uint64_t prev_period = socket_ptr->data.current_timestamp;
+        memcpy(&socket_ptr->data, &values[0], sizeof(netdata_socket_t));
+        if (translate)
+            ebpf_socket_translate(socket_ptr, &key);
+        else { // Check socket was updated
+            if (prev_period) {
+                if (values[0].current_timestamp > prev_period) // Socket updated
+                    socket_ptr->last_update = update_time;
+                else if ((update_time - socket_ptr->last_update) > em->update_every) {
+                    // Socket was not updated since last read
+                    JudyLDel(&pid_ptr->socket_stats.JudyLArray, values[0].first_timestamp, PJE0);
+                    aral_freez(aral_socket_table, socket_ptr);
+                }
+            } else // First time
+                socket_ptr->last_update = update_time;
+        }
 
-        if (!protocol)
-            protocol = w->protocol;
+        rw_spinlock_write_unlock(&pid_ptr->socket_stats.rw_spinlock);
+        rw_spinlock_write_unlock(&ebpf_judy_pid.index.rw_spinlock);
 
-        if (w->ct != ct)
-            ct = w->ct;
+end_socket_loop:
+        memset(values, 0, length);
+        memcpy(&key, &next_key, sizeof(key));
     }
-
-    values[0].recv_packets += precv;
-    values[0].sent_packets += psent;
-    values[0].recv_bytes   += brecv;
-    values[0].sent_bytes   += bsent;
-    values[0].retransmit   += retransmit;
-    values[0].protocol     = (!protocol)?IPPROTO_TCP:protocol;
-    values[0].ct           = ct;
-
-    uint32_t dir;
-    netdata_vector_plot_t *table = select_vector_to_store(&dir, key, protocol);
-    store_socket_inside_avl(table, &values[0], key, family, dir);
+    netdata_thread_enable_cancelability();
 }
 
 /**
- * Read socket hash table
+ * Socket thread
  *
- * Read data from hash tables created on kernel ring.
+ * Thread used to generate socket charts.
  *
- * @param fd                 the hash table with data.
- * @param family             the family associated to the hash table
- * @param maps_per_core      do I need to read all cores?
+ * @param ptr a pointer to `struct ebpf_module`
  *
- * @return it returns 0 on success and -1 otherwise.
+ * @return It always return NULL
  */
-static void ebpf_read_socket_hash_table(int fd, int family, int maps_per_core)
+void *ebpf_read_socket_thread(void *ptr)
 {
-    netdata_socket_idx_t key = {};
-    netdata_socket_idx_t next_key = {};
+    heartbeat_t hb;
+    heartbeat_init(&hb);
 
-    netdata_socket_t *values = socket_values;
-    size_t length = sizeof(netdata_socket_t);
-    int test, end;
-    if (maps_per_core) {
-        length *= ebpf_nprocs;
-        end = ebpf_nprocs;
-    } else
-        end = 1;
+    ebpf_module_t *em = (ebpf_module_t *)ptr;
 
-    while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
-        // We need to reset the values when we are working on kernel 4.15 or newer, because kernel does not create
-        // values for specific processor unless it is used to store data. As result of this behavior one the next socket
-        // can have values from the previous one.
-        memset(values, 0, length);
-        test = bpf_map_lookup_elem(fd, &key, values);
-        if (test < 0) {
-            key = next_key;
+    ebpf_update_array_vectors(em);
+
+    int update_every = em->update_every;
+    int counter = update_every - 1;
+
+    uint32_t running_time = 0;
+    uint32_t lifetime = em->lifetime;
+    usec_t period = update_every * USEC_PER_SEC;
+    while (!ebpf_plugin_exit && running_time < lifetime) {
+        (void)heartbeat_next(&hb, period);
+        if (ebpf_plugin_exit || ++counter != update_every)
             continue;
-        }
 
-        hash_accumulator(values, &key, family, end);
+        ebpf_update_array_vectors(em);
 
-        key = next_key;
+        counter = 0;
     }
+
+    return NULL;
 }
 
 /**
@@ -2165,44 +1862,6 @@ static void read_listen_table()
 }
 
 /**
- * Socket read hash
- *
- * This is the thread callback.
- * This thread is necessary, because we cannot freeze the whole plugin to read the data on very busy socket.
- *
- * @param ptr It is a NULL value for this thread.
- *
- * @return It always returns NULL.
- */
-void *ebpf_socket_read_hash(void *ptr)
-{
-    netdata_thread_cleanup_push(ebpf_socket_cleanup, ptr);
-    ebpf_module_t *em = (ebpf_module_t *)ptr;
-
-    heartbeat_t hb;
-    heartbeat_init(&hb);
-    int fd_ipv4 = socket_maps[NETDATA_SOCKET_TABLE_IPV4].map_fd;
-    int fd_ipv6 = socket_maps[NETDATA_SOCKET_TABLE_IPV6].map_fd;
-    int maps_per_core = em->maps_per_core;
-    // This thread is cancelled from another thread
-    uint32_t running_time;
-    uint32_t lifetime = em->lifetime;
-    for (running_time = 0;!ebpf_exit_plugin && running_time < lifetime; running_time++) {
-        (void)heartbeat_next(&hb, USEC_PER_SEC);
-        if (ebpf_exit_plugin)
-           break;
-
-        pthread_mutex_lock(&nv_mutex);
-        ebpf_read_socket_hash_table(fd_ipv4, AF_INET, maps_per_core);
-        ebpf_read_socket_hash_table(fd_ipv6, AF_INET6, maps_per_core);
-        pthread_mutex_unlock(&nv_mutex);
-    }
-
-    netdata_thread_cleanup_pop(1);
-    return NULL;
-}
-
-/**
  * Read the hash table and store data to allocated vectors.
  *
  * @param stats         vector used to read data from control table.
@@ -2251,9 +1910,9 @@ static void ebpf_socket_read_hash_global_tables(netdata_idx_t *stats, int maps_p
  * Fill publish apps when necessary.
  *
  * @param current_pid  the PID that I am updating
- * @param eb           the structure with data read from memory.
+ * @param ns           the structure with data read from memory.
  */
-void ebpf_socket_fill_publish_apps(uint32_t current_pid, ebpf_bandwidth_t *eb)
+void ebpf_socket_fill_publish_apps(uint32_t current_pid, netdata_socket_t *ns)
 {
     ebpf_socket_publish_apps_t *curr = socket_bandwidth_curr[current_pid];
     if (!curr) {
@@ -2261,98 +1920,33 @@ void ebpf_socket_fill_publish_apps(uint32_t current_pid, ebpf_bandwidth_t *eb)
         socket_bandwidth_curr[current_pid] = curr;
     }
 
-    curr->bytes_sent = eb->bytes_sent;
-    curr->bytes_received = eb->bytes_received;
-    curr->call_tcp_sent = eb->call_tcp_sent;
-    curr->call_tcp_received = eb->call_tcp_received;
-    curr->retransmit = eb->retransmit;
-    curr->call_udp_sent = eb->call_udp_sent;
-    curr->call_udp_received = eb->call_udp_received;
-    curr->call_close = eb->close;
-    curr->call_tcp_v4_connection = eb->tcp_v4_connection;
-    curr->call_tcp_v6_connection = eb->tcp_v6_connection;
-}
-
-/**
- * Bandwidth accumulator.
- *
- * @param out the vector with the values to sum
- */
-void ebpf_socket_bandwidth_accumulator(ebpf_bandwidth_t *out, int maps_per_core)
-{
-    int i, end = (maps_per_core) ? ebpf_nprocs : 1;
-    ebpf_bandwidth_t *total = &out[0];
-    for (i = 1; i < end; i++) {
-        ebpf_bandwidth_t *move = &out[i];
-        total->bytes_sent += move->bytes_sent;
-        total->bytes_received += move->bytes_received;
-        total->call_tcp_sent += move->call_tcp_sent;
-        total->call_tcp_received += move->call_tcp_received;
-        total->retransmit += move->retransmit;
-        total->call_udp_sent += move->call_udp_sent;
-        total->call_udp_received += move->call_udp_received;
-        total->close += move->close;
-        total->tcp_v4_connection += move->tcp_v4_connection;
-        total->tcp_v6_connection += move->tcp_v6_connection;
-    }
-}
-
-/**
- *  Update the apps data reading information from the hash table
- *
- * @param maps_per_core      do I need to read all cores?
- */
-static void ebpf_socket_update_apps_data(int maps_per_core)
-{
-    int fd = socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH].map_fd;
-    ebpf_bandwidth_t *eb = bandwidth_vector;
-    uint32_t key;
-    struct ebpf_pid_stat *pids = ebpf_root_of_pids;
-    size_t length = sizeof(ebpf_bandwidth_t);
-    if (maps_per_core)
-        length *= ebpf_nprocs;
-    while (pids) {
-        key = pids->pid;
-
-        if (bpf_map_lookup_elem(fd, &key, eb)) {
-            pids = pids->next;
-            continue;
-        }
-
-        ebpf_socket_bandwidth_accumulator(eb, maps_per_core);
-
-        ebpf_socket_fill_publish_apps(key, eb);
-
-        memset(eb, 0, length);
+    curr->bytes_sent += ns->tcp.tcp_bytes_sent;
+    curr->bytes_received += ns->tcp.tcp_bytes_received;
+    curr->call_tcp_sent += ns->tcp.call_tcp_sent;
+    curr->call_tcp_received += ns->tcp.call_tcp_received;
+    curr->retransmit += ns->tcp.retransmit;
+    curr->call_close += ns->tcp.close;
+    curr->call_tcp_v4_connection += ns->tcp.ipv4_connect;
+    curr->call_tcp_v6_connection += ns->tcp.ipv6_connect;
 
-        pids = pids->next;
-    }
+    curr->call_udp_sent += ns->udp.call_udp_sent;
+    curr->call_udp_received += ns->udp.call_udp_received;
 }
 
 /**
  * Update cgroup
  *
  * Update cgroup data based in PIDs.
- *
- * @param maps_per_core      do I need to read all cores?
  */
-static void ebpf_update_socket_cgroup(int maps_per_core)
+static void ebpf_update_socket_cgroup()
 {
     ebpf_cgroup_target_t *ect ;
 
-    ebpf_bandwidth_t *eb = bandwidth_vector;
-    int fd = socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH].map_fd;
-
-    size_t length = sizeof(ebpf_bandwidth_t);
-    if (maps_per_core)
-        length *= ebpf_nprocs;
-
     pthread_mutex_lock(&mutex_cgroup_shm);
     for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
         struct pid_on_target2 *pids;
         for (pids = ect->pids; pids; pids = pids->next) {
             int pid = pids->pid;
-            ebpf_bandwidth_t *out = &pids->socket;
             ebpf_socket_publish_apps_t *publish = &ect->publish_socket;
             if (likely(socket_bandwidth_curr) && socket_bandwidth_curr[pid]) {
                 ebpf_socket_publish_apps_t *in = socket_bandwidth_curr[pid];
@@ -2367,25 +1961,6 @@ static void ebpf_update_socket_cgroup(int maps_per_core)
                 publish->call_close = in->call_close;
                 publish->call_tcp_v4_connection = in->call_tcp_v4_connection;
                 publish->call_tcp_v6_connection = in->call_tcp_v6_connection;
-            } else {
-                if (!bpf_map_lookup_elem(fd, &pid, eb)) {
-                    ebpf_socket_bandwidth_accumulator(eb, maps_per_core);
-
-                    memcpy(out, eb, sizeof(ebpf_bandwidth_t));
-
-                    publish->bytes_sent = out->bytes_sent;
-                    publish->bytes_received = out->bytes_received;
-                    publish->call_tcp_sent = out->call_tcp_sent;
-                    publish->call_tcp_received = out->call_tcp_received;
-                    publish->retransmit = out->retransmit;
-                    publish->call_udp_sent = out->call_udp_sent;
-                    publish->call_udp_received = out->call_udp_received;
-                    publish->call_close = out->close;
-                    publish->call_tcp_v4_connection = out->tcp_v4_connection;
-                    publish->call_tcp_v6_connection = out->tcp_v6_connection;
-
-                    memset(eb, 0, length);
-                }
             }
         }
     }
@@ -2406,18 +1981,18 @@ static void ebpf_socket_sum_cgroup_pids(ebpf_socket_publish_apps_t *socket, stru
     memset(&accumulator, 0, sizeof(accumulator));
 
     while (pids) {
-        ebpf_bandwidth_t *w = &pids->socket;
-
-        accumulator.bytes_received += w->bytes_received;
-        accumulator.bytes_sent += w->bytes_sent;
-        accumulator.call_tcp_received += w->call_tcp_received;
-        accumulator.call_tcp_sent += w->call_tcp_sent;
-        accumulator.retransmit += w->retransmit;
-        accumulator.call_udp_received += w->call_udp_received;
-        accumulator.call_udp_sent += w->call_udp_sent;
-        accumulator.call_close += w->close;
-        accumulator.call_tcp_v4_connection += w->tcp_v4_connection;
-        accumulator.call_tcp_v6_connection += w->tcp_v6_connection;
+        netdata_socket_t *w = &pids->socket;
+
+        accumulator.bytes_received += w->tcp.tcp_bytes_received;
+        accumulator.bytes_sent += w->tcp.tcp_bytes_sent;
+        accumulator.call_tcp_received += w->tcp.call_tcp_received;
+        accumulator.call_tcp_sent += w->tcp.call_tcp_sent;
+        accumulator.retransmit += w->tcp.retransmit;
+        accumulator.call_close += w->tcp.close;
+        accumulator.call_tcp_v4_connection += w->tcp.ipv4_connect;
+        accumulator.call_tcp_v6_connection += w->tcp.ipv6_connect;
+        accumulator.call_udp_received += w->udp.call_udp_received;
+        accumulator.call_udp_sent += w->udp.call_udp_sent;
 
         pids = pids->next;
     }
@@ -2902,15 +2477,6 @@ static void socket_collector(ebpf_module_t *em)
 {
     heartbeat_t hb;
     heartbeat_init(&hb);
-    uint32_t network_connection = network_viewer_opt.enabled;
-
-    if (network_connection) {
-        socket_threads.thread = mallocz(sizeof(netdata_thread_t));
-        socket_threads.start_routine = ebpf_socket_read_hash;
-
-        netdata_thread_create(socket_threads.thread, socket_threads.name,
-                              NETDATA_THREAD_OPTION_DEFAULT, ebpf_socket_read_hash, em);
-    }
 
     int cgroups = em->cgroup_charts;
     if (cgroups)
@@ -2924,9 +2490,9 @@ static void socket_collector(ebpf_module_t *em)
     uint32_t lifetime = em->lifetime;
     netdata_idx_t *stats = em->hash_table_stats;
     memset(stats, 0, sizeof(em->hash_table_stats));
-    while (!ebpf_exit_plugin && running_time < lifetime) {
+    while (!ebpf_plugin_exit && running_time < lifetime) {
         (void)heartbeat_next(&hb, USEC_PER_SEC);
-        if (ebpf_exit_plugin || ++counter != update_every)
+        if (ebpf_plugin_exit || ++counter != update_every)
             continue;
 
         counter = 0;
@@ -2937,14 +2503,8 @@ static void socket_collector(ebpf_module_t *em)
         }
 
         pthread_mutex_lock(&collect_data_mutex);
-        if (socket_apps_enabled)
-            ebpf_socket_update_apps_data(maps_per_core);
-
         if (cgroups)
-            ebpf_update_socket_cgroup(maps_per_core);
-
-        if (network_connection)
-            calculate_nv_plot();
+            ebpf_update_socket_cgroup();
 
         pthread_mutex_lock(&lock);
         if (socket_global_enabled)
@@ -2963,20 +2523,6 @@ static void socket_collector(ebpf_module_t *em)
 
         fflush(stdout);
 
-        if (network_connection) {
-            // We are calling fflush many times, because when we have a lot of dimensions
-            // we began to have not expected outputs and Netdata closed the plugin.
-            pthread_mutex_lock(&nv_mutex);
-            ebpf_socket_create_nv_charts(&inbound_vectors, update_every);
-            fflush(stdout);
-            ebpf_socket_send_nv_data(&inbound_vectors);
-
-            ebpf_socket_create_nv_charts(&outbound_vectors, update_every);
-            fflush(stdout);
-            ebpf_socket_send_nv_data(&outbound_vectors);
-            pthread_mutex_unlock(&nv_mutex);
-
-        }
         pthread_mutex_unlock(&lock);
         pthread_mutex_unlock(&collect_data_mutex);
 
@@ -2998,42 +2544,24 @@ static void socket_collector(ebpf_module_t *em)
  *****************************************************************/
 
 /**
- * Allocate vectors used with this thread.
+ * Initialize vectors used with this thread.
+ *
  * We are not testing the return, because callocz does this and shutdown the software
  * case it was not possible to allocate.
- *
- * @param apps is apps enabled?
  */
-static void ebpf_socket_allocate_global_vectors(int apps)
+static void ebpf_socket_initialize_global_vectors()
 {
     memset(socket_aggregated_data, 0 ,NETDATA_MAX_SOCKET_VECTOR * sizeof(netdata_syscall_stat_t));
     memset(socket_publish_aggregated, 0 ,NETDATA_MAX_SOCKET_VECTOR * sizeof(netdata_publish_syscall_t));
     socket_hash_values = callocz(ebpf_nprocs, sizeof(netdata_idx_t));
 
-    if (apps) {
-        ebpf_socket_aral_init();
-        socket_bandwidth_curr = callocz((size_t)pid_max, sizeof(ebpf_socket_publish_apps_t *));
-        bandwidth_vector = callocz((size_t)ebpf_nprocs, sizeof(ebpf_bandwidth_t));
-    }
+    ebpf_socket_aral_init();
+    socket_bandwidth_curr = callocz((size_t)pid_max, sizeof(ebpf_socket_publish_apps_t *));
 
-    socket_values = callocz((size_t)ebpf_nprocs, sizeof(netdata_socket_t));
-    if (network_viewer_opt.enabled) {
-        inbound_vectors.plot = callocz(network_viewer_opt.max_dim, sizeof(netdata_socket_plot_t));
-        outbound_vectors.plot = callocz(network_viewer_opt.max_dim, sizeof(netdata_socket_plot_t));
-    }
-}
+    aral_socket_table = ebpf_allocate_pid_aral(NETDATA_EBPF_SOCKET_ARAL_TABLE_NAME,
+                                               sizeof(netdata_socket_plus_t));
 
-/**
- * Initialize Inbound and Outbound
- *
- * Initialize the common outbound and inbound sockets.
- */
-static void initialize_inbound_outbound()
-{
-    inbound_vectors.last = network_viewer_opt.max_dim - 1;
-    outbound_vectors.last = inbound_vectors.last;
-    fill_last_nv_dimension(&inbound_vectors.plot[inbound_vectors.last], 0);
-    fill_last_nv_dimension(&outbound_vectors.plot[outbound_vectors.last], 1);
+    socket_values = callocz((size_t)ebpf_nprocs, sizeof(netdata_socket_t));
 }
 
 /*****************************************************************
@@ -3043,793 +2571,6 @@ static void initialize_inbound_outbound()
  *****************************************************************/
 
 /**
- * Fill Port list
- *
- * @param out a pointer to the link list.
- * @param in the structure that will be linked.
- */
-static inline void fill_port_list(ebpf_network_viewer_port_list_t **out, ebpf_network_viewer_port_list_t *in)
-{
-    if (likely(*out)) {
-        ebpf_network_viewer_port_list_t *move = *out, *store = *out;
-        uint16_t first = ntohs(in->first);
-        uint16_t last = ntohs(in->last);
-        while (move) {
-            uint16_t cmp_first = ntohs(move->first);
-            uint16_t cmp_last = ntohs(move->last);
-            if (cmp_first <= first && first <= cmp_last  &&
-                cmp_first <= last && last <= cmp_last ) {
-                netdata_log_info("The range/value (%u, %u) is inside the range/value (%u, %u) already inserted, it will be ignored.",
-                     first, last, cmp_first, cmp_last);
-                freez(in->value);
-                freez(in);
-                return;
-            } else if (first <= cmp_first && cmp_first <= last  &&
-                       first <= cmp_last && cmp_last <= last) {
-                netdata_log_info("The range (%u, %u) is bigger than previous range (%u, %u) already inserted, the previous will be ignored.",
-                     first, last, cmp_first, cmp_last);
-                freez(move->value);
-                move->value = in->value;
-                move->first = in->first;
-                move->last = in->last;
-                freez(in);
-                return;
-            }
-
-            store = move;
-            move = move->next;
-        }
-
-        store->next = in;
-    } else {
-        *out = in;
-    }
-
-#ifdef NETDATA_INTERNAL_CHECKS
-    netdata_log_info("Adding values %s( %u, %u) to %s port list used on network viewer",
-         in->value, ntohs(in->first), ntohs(in->last),
-         (*out == network_viewer_opt.included_port)?"included":"excluded");
-#endif
-}
-
-/**
- * Parse Service List
- *
- * @param out a pointer to store the link list
- * @param service the service used to create the structure that will be linked.
- */
-static void parse_service_list(void **out, char *service)
-{
-    ebpf_network_viewer_port_list_t **list = (ebpf_network_viewer_port_list_t **)out;
-    struct servent *serv = getservbyname((const char *)service, "tcp");
-    if (!serv)
-        serv = getservbyname((const char *)service, "udp");
-
-    if (!serv) {
-        netdata_log_info("Cannot resolv the service '%s' with protocols TCP and UDP, it will be ignored", service);
-        return;
-    }
-
-    ebpf_network_viewer_port_list_t *w = callocz(1, sizeof(ebpf_network_viewer_port_list_t));
-    w->value = strdupz(service);
-    w->hash = simple_hash(service);
-
-    w->first = w->last = (uint16_t)serv->s_port;
-
-    fill_port_list(list, w);
-}
-
-/**
- * Netmask
- *
- * Copied from iprange (https://github.com/firehol/iprange/blob/master/iprange.h)
- *
- * @param prefix create the netmask based in the CIDR value.
- *
- * @return
- */
-static inline in_addr_t netmask(int prefix) {
-
-    if (prefix == 0)
-        return (~((in_addr_t) - 1));
-    else
-        return (in_addr_t)(~((1 << (32 - prefix)) - 1));
-
-}
-
-/**
- * Broadcast
- *
- * Copied from iprange (https://github.com/firehol/iprange/blob/master/iprange.h)
- *
- * @param addr is the ip address
- * @param prefix is the CIDR value.
- *
- * @return It returns the last address of the range
- */
-static inline in_addr_t broadcast(in_addr_t addr, int prefix)
-{
-    return (addr | ~netmask(prefix));
-}
-
-/**
- * Network
- *
- * Copied from iprange (https://github.com/firehol/iprange/blob/master/iprange.h)
- *
- * @param addr is the ip address
- * @param prefix is the CIDR value.
- *
- * @return It returns the first address of the range.
- */
-static inline in_addr_t ipv4_network(in_addr_t addr, int prefix)
-{
-    return (addr & netmask(prefix));
-}
-
-/**
- * IP to network long
- *
- * @param dst the vector to store the result
- * @param ip the source ip given by our users.
- * @param domain the ip domain (IPV4 or IPV6)
- * @param source the original string
- *
- * @return it returns 0 on success and -1 otherwise.
- */
-static inline int ip2nl(uint8_t *dst, char *ip, int domain, char *source)
-{
-    if (inet_pton(domain, ip, dst) <= 0) {
-        netdata_log_error("The address specified (%s) is invalid ", source);
-        return -1;
-    }
-
-    return 0;
-}
-
-/**
- * Get IPV6 Last Address
- *
- * @param out the address to store the last address.
- * @param in the address used to do the math.
- * @param prefix number of bits used to calculate the address
- */
-static void get_ipv6_last_addr(union netdata_ip_t *out, union netdata_ip_t *in, uint64_t prefix)
-{
-    uint64_t mask,tmp;
-    uint64_t ret[2];
-    memcpy(ret, in->addr32, sizeof(union netdata_ip_t));
-
-    if (prefix == 128) {
-        memcpy(out->addr32, in->addr32, sizeof(union netdata_ip_t));
-        return;
-    } else if (!prefix) {
-        ret[0] = ret[1] = 0xFFFFFFFFFFFFFFFF;
-        memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-        return;
-    } else if (prefix <= 64) {
-        ret[1] = 0xFFFFFFFFFFFFFFFFULL;
-
-        tmp = be64toh(ret[0]);
-        if (prefix > 0) {
-            mask = 0xFFFFFFFFFFFFFFFFULL << (64 - prefix);
-            tmp |= ~mask;
-        }
-        ret[0] = htobe64(tmp);
-    } else {
-        mask = 0xFFFFFFFFFFFFFFFFULL << (128 - prefix);
-        tmp = be64toh(ret[1]);
-        tmp |= ~mask;
-        ret[1] = htobe64(tmp);
-    }
-
-    memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-}
-
-/**
- * Calculate ipv6 first address
- *
- * @param out the address to store the first address.
- * @param in the address used to do the math.
- * @param prefix number of bits used to calculate the address
- */
-static void get_ipv6_first_addr(union netdata_ip_t *out, union netdata_ip_t *in, uint64_t prefix)
-{
-    uint64_t mask,tmp;
-    uint64_t ret[2];
-
-    memcpy(ret, in->addr32, sizeof(union netdata_ip_t));
-
-    if (prefix == 128) {
-        memcpy(out->addr32, in->addr32, sizeof(union netdata_ip_t));
-        return;
-    } else if (!prefix) {
-        ret[0] = ret[1] = 0;
-        memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-        return;
-    } else if (prefix <= 64) {
-        ret[1] = 0ULL;
-
-        tmp = be64toh(ret[0]);
-        if (prefix > 0) {
-            mask = 0xFFFFFFFFFFFFFFFFULL << (64 - prefix);
-            tmp &= mask;
-        }
-        ret[0] = htobe64(tmp);
-    } else {
-        mask = 0xFFFFFFFFFFFFFFFFULL << (128 - prefix);
-        tmp = be64toh(ret[1]);
-        tmp &= mask;
-        ret[1] = htobe64(tmp);
-    }
-
-    memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-}
-
-/**
- * Is ip inside the range
- *
- * Check if the ip is inside a IP range
- *
- * @param rfirst    the first ip address of the range
- * @param rlast     the last ip address of the range
- * @param cmpfirst  the first ip to compare
- * @param cmplast   the last ip to compare
- * @param family    the IP family
- *
- * @return It returns 1 if the IP is inside the range and 0 otherwise
- */
-static int ebpf_is_ip_inside_range(union netdata_ip_t *rfirst, union netdata_ip_t *rlast,
-                                   union netdata_ip_t *cmpfirst, union netdata_ip_t *cmplast, int family)
-{
-    if (family == AF_INET) {
-        if ((rfirst->addr32[0] <= cmpfirst->addr32[0]) && (rlast->addr32[0] >= cmplast->addr32[0]))
-            return 1;
-    } else {
-        if (memcmp(rfirst->addr8, cmpfirst->addr8, sizeof(union netdata_ip_t)) <= 0 &&
-            memcmp(rlast->addr8, cmplast->addr8, sizeof(union netdata_ip_t)) >= 0) {
-            return 1;
-        }
-
-    }
-    return 0;
-}
-
-/**
- * Fill IP list
- *
- * @param out a pointer to the link list.
- * @param in the structure that will be linked.
- * @param table the modified table.
- */
-void ebpf_fill_ip_list(ebpf_network_viewer_ip_list_t **out, ebpf_network_viewer_ip_list_t *in, char *table)
-{
-#ifndef NETDATA_INTERNAL_CHECKS
-    UNUSED(table);
-#endif
-    if (in->ver == AF_INET) { // It is simpler to compare using host order
-        in->first.addr32[0] = ntohl(in->first.addr32[0]);
-        in->last.addr32[0] = ntohl(in->last.addr32[0]);
-    }
-    if (likely(*out)) {
-        ebpf_network_viewer_ip_list_t *move = *out, *store = *out;
-        while (move) {
-            if (in->ver == move->ver &&
-                ebpf_is_ip_inside_range(&move->first, &move->last, &in->first, &in->last, in->ver)) {
-                netdata_log_info("The range/value (%s) is inside the range/value (%s) already inserted, it will be ignored.",
-                     in->value, move->value);
-                freez(in->value);
-                freez(in);
-                return;
-            }
-            store = move;
-            move = move->next;
-        }
-
-        store->next = in;
-    } else {
-        *out = in;
-    }
-
-#ifdef NETDATA_INTERNAL_CHECKS
-    char first[256], last[512];
-    if (in->ver == AF_INET) {
-        netdata_log_info("Adding values %s: (%u - %u) to %s IP list \"%s\" used on network viewer",
-             in->value, in->first.addr32[0], in->last.addr32[0],
-             (*out == network_viewer_opt.included_ips)?"included":"excluded",
-             table);
-    } else {
-        if (inet_ntop(AF_INET6, in->first.addr8, first, INET6_ADDRSTRLEN) &&
-            inet_ntop(AF_INET6, in->last.addr8, last, INET6_ADDRSTRLEN))
-            netdata_log_info("Adding values %s - %s to %s IP list \"%s\" used on network viewer",
-                 first, last,
-                 (*out == network_viewer_opt.included_ips)?"included":"excluded",
-                 table);
-    }
-#endif
-}
-
-/**
- * Parse IP List
- *
- * Parse IP list and link it.
- *
- * @param out a pointer to store the link list
- * @param ip the value given as parameter
- */
-static void ebpf_parse_ip_list(void **out, char *ip)
-{
-    ebpf_network_viewer_ip_list_t **list = (ebpf_network_viewer_ip_list_t **)out;
-
-    char *ipdup = strdupz(ip);
-    union netdata_ip_t first = { };
-    union netdata_ip_t last = { };
-    char *is_ipv6;
-    if (*ip == '*' && *(ip+1) == '\0') {
-        memset(first.addr8, 0, sizeof(first.addr8));
-        memset(last.addr8, 0xFF, sizeof(last.addr8));
-
-        is_ipv6 = ip;
-
-        clean_ip_structure(list);
-        goto storethisip;
-    }
-
-    char *end = ip;
-    // Move while I cannot find a separator
-    while (*end && *end != '/' && *end != '-') end++;
-
-    // We will use only the classic IPV6 for while, but we could consider the base 85 in a near future
-    // https://tools.ietf.org/html/rfc1924
-    is_ipv6 = strchr(ip, ':');
-
-    int select;
-    if (*end && !is_ipv6) { // IPV4 range
-        select = (*end == '/') ? 0 : 1;
-        *end++ = '\0';
-        if (*end == '!') {
-            netdata_log_info("The exclusion cannot be in the second part of the range %s, it will be ignored.", ipdup);
-            goto cleanipdup;
-        }
-
-        if (!select) { // CIDR
-            select = ip2nl(first.addr8, ip, AF_INET, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            select = (int) str2i(end);
-            if (select < NETDATA_MINIMUM_IPV4_CIDR || select > NETDATA_MAXIMUM_IPV4_CIDR) {
-                netdata_log_info("The specified CIDR %s is not valid, the IP %s will be ignored.", end, ip);
-                goto cleanipdup;
-            }
-
-            last.addr32[0] = htonl(broadcast(ntohl(first.addr32[0]), select));
-            // This was added to remove
-            // https://app.codacy.com/manual/netdata/netdata/pullRequest?prid=5810941&bid=19021977
-            UNUSED(last.addr32[0]);
-
-            uint32_t ipv4_test = htonl(ipv4_network(ntohl(first.addr32[0]), select));
-            if (first.addr32[0] != ipv4_test) {
-                first.addr32[0] = ipv4_test;
-                struct in_addr ipv4_convert;
-                ipv4_convert.s_addr = ipv4_test;
-                char ipv4_msg[INET_ADDRSTRLEN];
-                if(inet_ntop(AF_INET, &ipv4_convert, ipv4_msg, INET_ADDRSTRLEN))
-                    netdata_log_info("The network value of CIDR %s was updated for %s .", ipdup, ipv4_msg);
-            }
-        } else { // Range
-            select = ip2nl(first.addr8, ip, AF_INET, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            select = ip2nl(last.addr8, end, AF_INET, ipdup);
-            if (select)
-                goto cleanipdup;
-        }
-
-        if (htonl(first.addr32[0]) > htonl(last.addr32[0])) {
-            netdata_log_info("The specified range %s is invalid, the second address is smallest than the first, it will be ignored.",
-                 ipdup);
-            goto cleanipdup;
-        }
-    } else if (is_ipv6) { // IPV6
-        if (!*end) { // Unique
-            select = ip2nl(first.addr8, ip, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            memcpy(last.addr8, first.addr8, sizeof(first.addr8));
-        } else if (*end == '-') {
-            *end++ = 0x00;
-            if (*end == '!') {
-                netdata_log_info("The exclusion cannot be in the second part of the range %s, it will be ignored.", ipdup);
-                goto cleanipdup;
-            }
-
-            select = ip2nl(first.addr8, ip, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            select = ip2nl(last.addr8, end, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-        } else { // CIDR
-            *end++ = 0x00;
-            if (*end == '!') {
-                netdata_log_info("The exclusion cannot be in the second part of the range %s, it will be ignored.", ipdup);
-                goto cleanipdup;
-            }
-
-            select = str2i(end);
-            if (select < 0 || select > 128) {
-                netdata_log_info("The CIDR %s is not valid, the address %s will be ignored.", end, ip);
-                goto cleanipdup;
-            }
-
-            uint64_t prefix = (uint64_t)select;
-            select = ip2nl(first.addr8, ip, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            get_ipv6_last_addr(&last, &first, prefix);
-
-            union netdata_ip_t ipv6_test;
-            get_ipv6_first_addr(&ipv6_test, &first, prefix);
-
-            if (memcmp(first.addr8, ipv6_test.addr8, sizeof(union netdata_ip_t)) != 0) {
-                memcpy(first.addr8, ipv6_test.addr8, sizeof(union netdata_ip_t));
-
-                struct in6_addr ipv6_convert;
-                memcpy(ipv6_convert.s6_addr,  ipv6_test.addr8, sizeof(union netdata_ip_t));
-
-                char ipv6_msg[INET6_ADDRSTRLEN];
-                if(inet_ntop(AF_INET6, &ipv6_convert, ipv6_msg, INET6_ADDRSTRLEN))
-                    netdata_log_info("The network value of CIDR %s was updated for %s .", ipdup, ipv6_msg);
-            }
-        }
-
-        if ((be64toh(*(uint64_t *)&first.addr32[2]) > be64toh(*(uint64_t *)&last.addr32[2]) &&
-             !memcmp(first.addr32, last.addr32, 2*sizeof(uint32_t))) ||
-            (be64toh(*(uint64_t *)&first.addr32) > be64toh(*(uint64_t *)&last.addr32)) ) {
-            netdata_log_info("The specified range %s is invalid, the second address is smallest than the first, it will be ignored.",
-                 ipdup);
-            goto cleanipdup;
-        }
-    } else { // Unique ip
-        select = ip2nl(first.addr8, ip, AF_INET, ipdup);
-        if (select)
-            goto cleanipdup;
-
-        memcpy(last.addr8, first.addr8, sizeof(first.addr8));
-    }
-
-    ebpf_network_viewer_ip_list_t *store;
-
-storethisip:
-    store = callocz(1, sizeof(ebpf_network_viewer_ip_list_t));
-    store->value = ipdup;
-    store->hash = simple_hash(ipdup);
-    store->ver = (uint8_t)(!is_ipv6)?AF_INET:AF_INET6;
-    memcpy(store->first.addr8, first.addr8, sizeof(first.addr8));
-    memcpy(store->last.addr8, last.addr8, sizeof(last.addr8));
-
-    ebpf_fill_ip_list(list, store, "socket");
-    return;
-
-cleanipdup:
-    freez(ipdup);
-}
-
-/**
- * Parse IP Range
- *
- * Parse the IP ranges given and create Network Viewer IP Structure
- *
- * @param ptr  is a pointer with the text to parse.
- */
-static void ebpf_parse_ips(char *ptr)
-{
-    // No value
-    if (unlikely(!ptr))
-        return;
-
-    while (likely(ptr)) {
-        // Move forward until next valid character
-        while (isspace(*ptr)) ptr++;
-
-        // No valid value found
-        if (unlikely(!*ptr))
-            return;
-
-        // Find space that ends the list
-        char *end = strchr(ptr, ' ');
-        if (end) {
-            *end++ = '\0';
-        }
-
-        int neg = 0;
-        if (*ptr == '!') {
-            neg++;
-            ptr++;
-        }
-
-        if (isascii(*ptr)) { // Parse port
-            ebpf_parse_ip_list((!neg)?(void **)&network_viewer_opt.included_ips:
-                                      (void **)&network_viewer_opt.excluded_ips,
-                                ptr);
-        }
-
-        ptr = end;
-    }
-}
-
-
-
-/**
- * Parse port list
- *
- * Parse an allocated port list with the range given
- *
- * @param out a pointer to store the link list
- * @param range the informed range for the user.
- */
-static void parse_port_list(void **out, char *range)
-{
-    int first, last;
-    ebpf_network_viewer_port_list_t **list = (ebpf_network_viewer_port_list_t **)out;
-
-    char *copied = strdupz(range);
-    if (*range == '*' && *(range+1) == '\0') {
-        first = 1;
-        last = 65535;
-
-        clean_port_structure(list);
-        goto fillenvpl;
-    }
-
-    char *end = range;
-    //Move while I cannot find a separator
-    while (*end && *end != ':' && *end != '-') end++;
-
-    //It has a range
-    if (likely(*end)) {
-        *end++ = '\0';
-        if (*end == '!') {
-            netdata_log_info("The exclusion cannot be in the second part of the range, the range %s will be ignored.", copied);
-            freez(copied);
-            return;
-        }
-        last = str2i((const char *)end);
-    } else {
-        last = 0;
-    }
-
-    first = str2i((const char *)range);
-    if (first < NETDATA_MINIMUM_PORT_VALUE || first > NETDATA_MAXIMUM_PORT_VALUE) {
-        netdata_log_info("The first port %d of the range \"%s\" is invalid and it will be ignored!", first, copied);
-        freez(copied);
-        return;
-    }
-
-    if (!last)
-        last = first;
-
-    if (last < NETDATA_MINIMUM_PORT_VALUE || last > NETDATA_MAXIMUM_PORT_VALUE) {
-        netdata_log_info("The second port %d of the range \"%s\" is invalid and the whole range will be ignored!", last, copied);
-        freez(copied);
-        return;
-    }
-
-    if (first > last) {
-        netdata_log_info("The specified order %s is wrong, the smallest value is always the first, it will be ignored!", copied);
-        freez(copied);
-        return;
-    }
-
-    ebpf_network_viewer_port_list_t *w;
-fillenvpl:
-    w = callocz(1, sizeof(ebpf_network_viewer_port_list_t));
-    w->value = copied;
-    w->hash = simple_hash(copied);
-    w->first = (uint16_t)htons((uint16_t)first);
-    w->last = (uint16_t)htons((uint16_t)last);
-    w->cmp_first = (uint16_t)first;
-    w->cmp_last = (uint16_t)last;
-
-    fill_port_list(list, w);
-}
-
-/**
- * Read max dimension.
- *
- * Netdata plot two dimensions per connection, so it is necessary to adjust the values.
- *
- * @param cfg the configuration structure
- */
-static void read_max_dimension(struct config *cfg)
-{
-    int maxdim ;
-    maxdim = (int) appconfig_get_number(cfg,
-                                        EBPF_NETWORK_VIEWER_SECTION,
-                                        EBPF_MAXIMUM_DIMENSIONS,
-                                        NETDATA_NV_CAP_VALUE);
-    if (maxdim < 0) {
-        netdata_log_error("'maximum dimensions = %d' must be a positive number, Netdata will change for default value %ld.",
-              maxdim, NETDATA_NV_CAP_VALUE);
-        maxdim = NETDATA_NV_CAP_VALUE;
-    }
-
-    maxdim /= 2;
-    if (!maxdim) {
-        netdata_log_info("The number of dimensions is too small (%u), we are setting it to minimum 2", network_viewer_opt.max_dim);
-        network_viewer_opt.max_dim = 1;
-        return;
-    }
-
-    network_viewer_opt.max_dim = (uint32_t)maxdim;
-}
-
-/**
- * Parse Port Range
- *
- * Parse the port ranges given and create Network Viewer Port Structure
- *
- * @param ptr  is a pointer with the text to parse.
- */
-static void parse_ports(char *ptr)
-{
-    // No value
-    if (unlikely(!ptr))
-        return;
-
-    while (likely(ptr)) {
-        // Move forward until next valid character
-        while (isspace(*ptr)) ptr++;
-
-        // No valid value found
-        if (unlikely(!*ptr))
-            return;
-
-        // Find space that ends the list
-        char *end = strchr(ptr, ' ');
-        if (end) {
-            *end++ = '\0';
-        }
-
-        int neg = 0;
-        if (*ptr == '!') {
-            neg++;
-            ptr++;
-        }
-
-        if (isdigit(*ptr)) { // Parse port
-            parse_port_list((!neg)?(void **)&network_viewer_opt.included_port:(void **)&network_viewer_opt.excluded_port,
-                            ptr);
-        } else if (isalpha(*ptr)) { // Parse service
-            parse_service_list((!neg)?(void **)&network_viewer_opt.included_port:(void **)&network_viewer_opt.excluded_port,
-                               ptr);
-        } else if (*ptr == '*') { // All
-            parse_port_list((!neg)?(void **)&network_viewer_opt.included_port:(void **)&network_viewer_opt.excluded_port,
-                            ptr);
-        }
-
-        ptr = end;
-    }
-}
-
-/**
- * Link hostname
- *
- * @param out is the output link list
- * @param in the hostname to add to list.
- */
-static void link_hostname(ebpf_network_viewer_hostname_list_t **out, ebpf_network_viewer_hostname_list_t *in)
-{
-    if (likely(*out)) {
-        ebpf_network_viewer_hostname_list_t *move = *out;
-        for (; move->next ; move = move->next ) {
-            if (move->hash == in->hash && !strcmp(move->value, in->value)) {
-                netdata_log_info("The hostname %s was already inserted, it will be ignored.", in->value);
-                freez(in->value);
-                simple_pattern_free(in->value_pattern);
-                freez(in);
-                return;
-            }
-        }
-
-        move->next = in;
-    } else {
-        *out = in;
-    }
-#ifdef NETDATA_INTERNAL_CHECKS
-    netdata_log_info("Adding value %s to %s hostname list used on network viewer",
-         in->value,
-         (*out == network_viewer_opt.included_hostnames)?"included":"excluded");
-#endif
-}
-
-/**
- * Link Hostnames
- *
- * Parse the list of hostnames to create the link list.
- * This is not associated with the IP, because simple patterns like *example* cannot be resolved to IP.
- *
- * @param out is the output link list
- * @param parse is a pointer with the text to parser.
- */
-static void link_hostnames(char *parse)
-{
-    // No value
-    if (unlikely(!parse))
-        return;
-
-    while (likely(parse)) {
-        // Find the first valid value
-        while (isspace(*parse)) parse++;
-
-        // No valid value found
-        if (unlikely(!*parse))
-            return;
-
-        // Find space that ends the list
-        char *end = strchr(parse, ' ');
-        if (end) {
-            *end++ = '\0';
-        }
-
-        int neg = 0;
-        if (*parse == '!') {
-            neg++;
-            parse++;
-        }
-
-        ebpf_network_viewer_hostname_list_t *hostname = callocz(1 , sizeof(ebpf_network_viewer_hostname_list_t));
-        hostname->value = strdupz(parse);
-        hostname->hash = simple_hash(parse);
-        hostname->value_pattern = simple_pattern_create(parse, NULL, SIMPLE_PATTERN_EXACT, true);
-
-        link_hostname((!neg)?&network_viewer_opt.included_hostnames:&network_viewer_opt.excluded_hostnames,
-                      hostname);
-
-        parse = end;
-    }
-}
-
-/**
- * Parse network viewer section
- *
- * @param cfg the configuration structure
- */
-void parse_network_viewer_section(struct config *cfg)
-{
-    read_max_dimension(cfg);
-
-    network_viewer_opt.hostname_resolution_enabled = appconfig_get_boolean(cfg,
-                                                                           EBPF_NETWORK_VIEWER_SECTION,
-                                                                           EBPF_CONFIG_RESOLVE_HOSTNAME,
-                                                                           CONFIG_BOOLEAN_NO);
-
-    network_viewer_opt.service_resolution_enabled = appconfig_get_boolean(cfg,
-                                                                          EBPF_NETWORK_VIEWER_SECTION,
-                                                                          EBPF_CONFIG_RESOLVE_SERVICE,
-                                                                          CONFIG_BOOLEAN_NO);
-
-    char *value = appconfig_get(cfg, EBPF_NETWORK_VIEWER_SECTION, EBPF_CONFIG_PORTS, NULL);
-    parse_ports(value);
-
-    if (network_viewer_opt.hostname_resolution_enabled) {
-        value = appconfig_get(cfg, EBPF_NETWORK_VIEWER_SECTION, EBPF_CONFIG_HOSTNAMES, NULL);
-        link_hostnames(value);
-    } else {
-        netdata_log_info("Name resolution is disabled, collector will not parser \"hostnames\" list.");
-    }
-
-    value = appconfig_get(cfg, EBPF_NETWORK_VIEWER_SECTION,
-                          "ips", "!127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128");
-    ebpf_parse_ips(value);
-}
-
-/**
  * Link dimension name
  *
  * Link user specified names inside a link list.
@@ -3838,7 +2579,7 @@ void parse_network_viewer_section(struct config *cfg)
  * @param hash the calculated hash for the dimension name.
  * @param name the dimension name.
  */
-static void link_dimension_name(char *port, uint32_t hash, char *value)
+static void ebpf_link_dimension_name(char *port, uint32_t hash, char *value)
 {
     int test = str2i(port);
     if (test < NETDATA_MINIMUM_PORT_VALUE || test > NETDATA_MAXIMUM_PORT_VALUE){
@@ -3883,13 +2624,13 @@ static void link_dimension_name(char *port, uint32_t hash, char *value)
  *
  * @param cfg the configuration structure
  */
-void parse_service_name_section(struct config *cfg)
+void ebpf_parse_service_name_section(struct config *cfg)
 {
     struct section *co = appconfig_get_section(cfg, EBPF_SERVICE_NAME_SECTION);
     if (co) {
         struct config_option *cv;
         for (cv = co->values; cv ; cv = cv->next) {
-            link_dimension_name(cv->name, cv->hash, cv->value);
+            ebpf_link_dimension_name(cv->name, cv->hash, cv->value);
         }
     }
 
@@ -3910,23 +2651,21 @@ void parse_service_name_section(struct config *cfg)
         // if variable has an invalid value, we assume netdata is using 19999
         int default_port = str2i(port_string);
         if (default_port > 0 && default_port < 65536)
-            link_dimension_name(port_string, simple_hash(port_string), "Netdata");
+            ebpf_link_dimension_name(port_string, simple_hash(port_string), "Netdata");
     }
 }
 
+/**
+ * Parse table size options
+ *
+ * @param cfg configuration options read from user file.
+ */
 void parse_table_size_options(struct config *cfg)
 {
-    socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH].user_input = (uint32_t) appconfig_get_number(cfg,
-                                                                                            EBPF_GLOBAL_SECTION,
-                                                                                            EBPF_CONFIG_BANDWIDTH_SIZE, NETDATA_MAXIMUM_CONNECTIONS_ALLOWED);
-
-    socket_maps[NETDATA_SOCKET_TABLE_IPV4].user_input = (uint32_t) appconfig_get_number(cfg,
-                                                                                       EBPF_GLOBAL_SECTION,
-                                                                                       EBPF_CONFIG_IPV4_SIZE, NETDATA_MAXIMUM_CONNECTIONS_ALLOWED);
-
-    socket_maps[NETDATA_SOCKET_TABLE_IPV6].user_input = (uint32_t) appconfig_get_number(cfg,
-                                                                                       EBPF_GLOBAL_SECTION,
-                                                                                       EBPF_CONFIG_IPV6_SIZE, NETDATA_MAXIMUM_CONNECTIONS_ALLOWED);
+    socket_maps[NETDATA_SOCKET_OPEN_SOCKET].user_input = (uint32_t) appconfig_get_number(cfg,
+                                                                                        EBPF_GLOBAL_SECTION,
+                                                                                        EBPF_CONFIG_SOCKET_MONITORING_SIZE,
+                                                                                        NETDATA_MAXIMUM_CONNECTIONS_ALLOWED);
 
     socket_maps[NETDATA_SOCKET_TABLE_UDP].user_input = (uint32_t) appconfig_get_number(cfg,
                                                                                       EBPF_GLOBAL_SECTION,
@@ -3965,7 +2704,7 @@ static int ebpf_socket_load_bpf(ebpf_module_t *em)
 #endif
 
     if (ret) {
-        netdata_log_error("%s %s", EBPF_DEFAULT_ERROR_MSG, em->thread_name);
+        netdata_log_error("%s %s", EBPF_DEFAULT_ERROR_MSG, em->info.thread_name);
     }
 
     return ret;
@@ -3985,25 +2724,23 @@ void *ebpf_socket_thread(void *ptr)
     netdata_thread_cleanup_push(ebpf_socket_exit, ptr);
 
     ebpf_module_t *em = (ebpf_module_t *)ptr;
-    em->maps = socket_maps;
-
-    parse_table_size_options(&socket_config);
-
-    if (pthread_mutex_init(&nv_mutex, NULL)) {
-        netdata_log_error("Cannot initialize local mutex");
-        goto endsocket;
+    if (em->enabled > NETDATA_THREAD_EBPF_FUNCTION_RUNNING) {
+        collector_error("There is already a thread %s running", em->info.thread_name);
+        return NULL;
     }
 
-    ebpf_socket_allocate_global_vectors(em->apps_charts);
+    em->maps = socket_maps;
 
-    if (network_viewer_opt.enabled) {
-        memset(&inbound_vectors.tree, 0, sizeof(avl_tree_lock));
-        memset(&outbound_vectors.tree, 0, sizeof(avl_tree_lock));
-        avl_init_lock(&inbound_vectors.tree, ebpf_compare_sockets);
-        avl_init_lock(&outbound_vectors.tree, ebpf_compare_sockets);
+    rw_spinlock_write_lock(&network_viewer_opt.rw_spinlock);
+    // It was not enabled from main config file (ebpf.d.conf)
+    if (!network_viewer_opt.enabled)
+        network_viewer_opt.enabled = appconfig_get_boolean(&socket_config, EBPF_NETWORK_VIEWER_SECTION, "enabled",
+                                                           CONFIG_BOOLEAN_YES);
+    rw_spinlock_write_unlock(&network_viewer_opt.rw_spinlock);
 
-        initialize_inbound_outbound();
-    }
+    parse_table_size_options(&socket_config);
+
+    ebpf_socket_initialize_global_vectors();
 
     if (running_on_kernel < NETDATA_EBPF_KERNEL_5_0)
         em->mode = MODE_ENTRY;
@@ -4026,8 +2763,15 @@ void *ebpf_socket_thread(void *ptr)
         socket_aggregated_data, socket_publish_aggregated, socket_dimension_names, socket_id_names,
         algorithms, NETDATA_MAX_SOCKET_VECTOR);
 
+    ebpf_read_socket.thread = mallocz(sizeof(netdata_thread_t));
+    netdata_thread_create(ebpf_read_socket.thread,
+                          ebpf_read_socket.name,
+                          NETDATA_THREAD_OPTION_DEFAULT,
+                          ebpf_read_socket_thread,
+                          em);
+
     pthread_mutex_lock(&lock);
-    ebpf_create_global_charts(em);
+    ebpf_socket_create_global_charts(em);
 
     ebpf_update_stats(&plugin_statistics, em);
     ebpf_update_kernel_memory_with_vector(&plugin_statistics, em->maps, EBPF_ACTION_STAT_ADD);