Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add context info to packet captures #4050

Closed
oshaked1 opened this issue May 15, 2024 · 0 comments · Fixed by #4072
Closed

Add context info to packet captures #4050

oshaked1 opened this issue May 15, 2024 · 0 comments · Fixed by #4072

Comments

@oshaked1
Copy link
Contributor

Right now, the only way to associate a packet capture with the context from which the packets were captured is using the file name generated by tracee. This only gives us the container/PID/command, and nothing more.

The network events from which the packets are obtained include much more context. This context should be added to the PCAP file.

A possible implementation involves generating an interface description (see if_description option of Interface Description Block) for each capture file that contains all context that is shared between all packets of that capture file. The description can be in any text format, JSON being probably the best option.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant