where is the action of delte tc filter

[boost2020]

There is a code with this annotation in file probe_openssl_pcap.go:

			// customize deleteed TC filter
			// tc filter del dev eth0 ingress
			// tc filter del dev eth0 egress
			// loopback devices are special, some tc probes should be skipped
			// TODO: detect loopback devices via aquasecrity/tracee/pkg/ebpf/probes/probe.go line 322
			// isNetIfaceLo := netIface.Flags&net.FlagLoopback == net.FlagLoopback
			//	if isNetIfaceLo && p.skipLoopback {
			//		return nil
			//	}

So the question I want to ask is, when using the PCAP module, will the original ingress/egress tc filter be deleted first, and then the tc filter will be regenerated

[boost2020]

@cfc4n can you help me

[cfc4n]

Sorry, I forgot to reply. I‘ll have a look on the weekend. If you forget it, please remind me.

[boost2020]

Could you take a look at this for me when you have a chance @cfc4n

[cfc4n]

eCapture only clears the tc filters it creates itself; you can refer to https://github.com/gojue/ebpfmanager/blob/11525325c96c65722b2c2096fce73ba9122bb922/examples/clone_vs_add_hook/demo.go#L72