coroot-node-agent Do we plan to support inbound traffic parsing?

Currently, coroot-node-agent only parses network packets that the current node service actively requests for other services. However, in many scenarios, coroot-node-agent cannot be deployed to all nodes. Can it support parsing network packets requested by external services to build a more complete service topology?

Jul 05 '24 08:07 wenhuwang

Yes, we have plans to implement this. Here is a similar issue in the main repo: coroot/coroot#281

Jul 05 '24 10:07 def

How is the progress of this feature? I am interested in this feature and would like to contribute if possible.

Jul 08 '24 01:07 wenhuwang

Is has any new progress of this feature?

Aug 15 '24 09:08 gravese

https://github.com/StLeoX/coroot-node-agent/commit/667b19c0ea0ba8820d1978268e8fc4c934ac646d

Here I design l7_event's corresponding in-bound traffic l7_event_ss (ss means server-side, current process working as the server). But I meet the problem, I can't filter l7_event_ss by active TCP connections and FDs correctly. Anyone could give me some advice? @wenhuwang @gravese

Jan 17 '25 02:01 StLeoX

Is there any progress on this issue now? I follow the current logic, If enter_read first then enter_write, I'll consider it as inbound traffic, it works, but I don't know if there are some exceptions.

May 13 '25 03:05 evanzhang87