tracee icon indicating copy to clipboard operation
tracee copied to clipboard

Published 20 hours ago • verified publisher icon aquasecurity

[RFC][DRAFT] new network code

Open rafaeldtinoco opened this issue 3 years ago • 1 comments

This is a draft. There are some issues I'm already aware, so no full review should be done, please (not yet). BUT, feel free to get familiarized with this if you need/want.

$ sudo ./dist/tracee-ebpf --output format:json -t event=new_net_packet,new_dns_request -t comm=nc,ping

PS: DNS event is not actually a DNS event (yet), just testing things around.

rafaeldtinoco avatar Sep 19 '22 05:09 rafaeldtinoco

Full tracing (all processes) network probes do not seem to be causing slowdowns in a simple Gbit network:

image

image

rafaeldtinoco avatar Sep 20 '22 01:09 rafaeldtinoco

I'm closing this for a new cleaned/rebased PR.

rafaeldtinoco avatar Sep 28 '22 03:09 rafaeldtinoco