imsnif/bandwhich

Traffic misidentification on routing host

Open

#447 opened on Dec 6, 2024

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Rust (7,686 stars) (237 forks)batch import
bughelp wanted

Description

Three machines are involved here:

  • My personal laptop A, connected to the local network (green).
  • The server S that routes traffic between the local network and the OpenVPN subnet, on which bandwhich is running.
    • S has two addresses - a local network address Slocal and an OpenVPN subnet address Svpn.
  • A remote client machine B connected to the OpenVPN subnet (cyan).
    • B has two addresses - a public address Bpub and an OpenVPN subnet address Bvpn.

Misidentified traffic

Here I am initiating a file transfer on A using scp from A to Bvpn, so on layer 4 the connection should be from A:56994 to Bvpn:22.

But bandwhich seems to believe that it's from A:56994 to Slocal:22 instead, and by extension believes that this traffic should be attributed to the local sshd process.

I think I've got some clues on what's wrong. Help welcomed nonetheless.

Contributor guide

Tech stack
rust
Domain
cliobservability
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
needs investigation
Prerequisites
Rustnetworking concepts
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Investigate the issue by reproducing the described scenario with three machines and scp transfer. Examine the Rust code in the repository that handles traffic identification and connection tracking, particularly how it maps IP addresses and ports to processes. Look for any assumptions about routing that might cause misidentification when traffic traverses a VPN. The user provided clues; compare the expected behavior with the actual output to pinpoint where the logic fails. Check if there are any existing tests for multi homed hosts or VPN scenarios.