SysmonForLinux icon indicating copy to clipboard operation
SysmonForLinux copied to clipboard

Network Accept tracker to handle empty address

Open kesheldr opened this issue 4 years ago • 0 comments

If an application calls accept() with the addr argument set to NULL, then the remote IP address and port will be set to 0. The networkTracker::seenAccept() function needs to recognise this situation and look up the details in /proc using the file descriptor. If the connection isn't in /proc then it should return true with both addresses and ports set to 0, so that the received connection is still reported, even though the addresses and ports are empty.

A further enhancement would be to track calls to bind() and store the local address and port against the file descriptor, so that in the condition where addr is NULL, the local port can be used to match against the cache of connections.

kesheldr avatar Nov 29 '21 15:11 kesheldr