Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add context info to packet captures #4050

Open
oshaked1 opened this issue May 15, 2024 · 0 comments · May be fixed by #4072
Open

Add context info to packet captures #4050

oshaked1 opened this issue May 15, 2024 · 0 comments · May be fixed by #4072

Comments

@oshaked1
Copy link
Contributor

Right now, the only way to associate a packet capture with the context from which the packets were captured is using the file name generated by tracee. This only gives us the container/PID/command, and nothing more.

The network events from which the packets are obtained include much more context. This context should be added to the PCAP file.

A possible implementation involves generating an interface description (see if_description option of Interface Description Block) for each capture file that contains all context that is shared between all packets of that capture file. The description can be in any text format, JSON being probably the best option.

@oshaked1 oshaked1 self-assigned this May 15, 2024
@oshaked1 oshaked1 added this to the v0.22.0 milestone May 15, 2024
@oshaked1 oshaked1 linked a pull request May 22, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant