microsoft/retina

Support capturing/tracing unix domain sockets with kprobe ebpf

Open

#225 创建于 2024年4月4日

在 GitHub 查看
 (4 评论) (0 反应) (0 负责人)Go (293 fork)auto 404
area/ebpfarea/pluginshelp wantedpriority/1type/enhancement

仓库指标

Star
 (3,161 star)
PR 合并指标
 (PR 指标待抓取)

描述

Today Retina only watches for events from either tc prog or some drop reason kprobes, Retina should be watching for events of unix domain socket as well. This will need additional work to understand how to distinguish src and dest pod/container/process.

For starters, attaching to below kprobes: kprobe/unix_stream_sendmsg kprobe/unix_dgram_sendmsg fentry/unix_stream_sendmsg fentry/unix_dgram_sendmsg

Example: https://github.com/Asphaltt/sockdump

贡献者指南