feat(sight): add tcpsniff probe for plain HTTP traffic capture#587
Merged
Conversation
Daydreamer-Li
force-pushed
the
feat/sight/mem_opt
branch
from
0860102 to
da7c21e
Compare
chengshuyi
reviewed
May 21, 2026
| /// Useful when the agent routes through a local gateway (e.g. Higress) via HTTP. | ||
| #[structopt(long, use_delimiter = true)] | ||
| pub tcp_ports: Vec<u16>, | ||
|
|
Collaborator
There was a problem hiding this comment.
不需要指定port，建议通过现有的domain_rules来进行过滤
Daydreamer-Li
force-pushed
the
feat/sight/mem_opt
branch
from
9a96ef9 to
d66db32
Compare
chengshuyi
previously approved these changes
May 22, 2026
Add eBPF-based TCP traffic capture (fentry/fexit on tcp_sendmsg and tcp_recvmsg) to observe plain-text HTTP calls routed through local gateways like Higress on configurable ports (default: 8080). Key design decisions: - Reuses probe_SSL_data_t event format so the entire downstream pipeline (parser, aggregator, analyzer, GenAI, storage) works unchanged. - Handles writev scatter-gather: concatenates iov[0] (headers) + iov[1] (body) into a single event buffer for correct request parsing. - CO-RE compatibility for iov_iter field renames (iov vs __iov) and ITER_UBUF (kernel 6.0+) vs ITER_IOVEC. - Multi-kernel support (5.8+): compiles two fexit variants for tcp_recvmsg signature change (nonblock param removed in 5.18); userspace auto-detects via load-and-fallback at runtime. - Stashes user_buf pointer at fentry to avoid reading advanced iov_iter at fexit (kernel advances ubuf pointer during tcp_recvmsg). Signed-off-by: liyuqing <liyuqing@alibaba-inc.com>
…ff IP/port filtering 1. tcpsniff: replace port-only filtering with flexible IP/port/IP+port target configuration via BPF composite key map. Remove PID filtering from BPF layer — tcpsniff now captures all TCP to configured targets, relying on userspace for LLM call identification. 2. User-Agent fallback: when cmdline-based agent detection fails, fall back to matching HTTP User-Agent header against configurable glob rules in agentsight.json. Detected agent names are cached in pid_agent_name_cache and backfilled into TokenRecord.agent. 3. AuditRecord token fix: reorder audit extraction after token resolution so AuditRecord gets real token counts instead of hardcoded zeros. Signed-off-by: liyuqing <liyuqing@alibaba-inc.com>
…nstead of User-Agent matching Replace the User-Agent header matching logic with a simpler approach: use the process comm name as the agent name fallback when cmdline matching and pid_agent_name_cache both fail. This is more reliable for tcpsniff scenarios where PID info may be unreliable. Signed-off-by: liyuqing <liyuqing@alibaba-inc.com>
Signed-off-by: liyuqing <liyuqing@alibaba-inc.com>
Signed-off-by: liyuqing <liyuqing@alibaba-inc.com>
Daydreamer-Li
force-pushed
the
feat/sight/mem_opt
branch
from
60d8a4e to
7a55fc4
Compare
chengshuyi
approved these changes
May 22, 2026
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add tcpsniff eBPF probe for capturing plain HTTP traffic, enabling observation of unencrypted HTTP requests/responses for LLM API calls that don't use TLS (e.g., local proxies, internal services).
Related Issue
closes #588
Type of Change
Scope
sight(agentsight)Checklist
sight:cargo clippy -- -D warningsandcargo fmt --checkpassCargo.lock)Testing
Tested tcpsniff probe attachment and plain HTTP traffic capture manually on alinux3 with kernel 5.10+.
Additional Notes
This probe complements the existing SSL probe by capturing unencrypted HTTP traffic for complete LLM API observability.