Skip to content

Use inodes for listing connections on Linux - #224

Merged
panhania merged 2 commits into
google:masterfrom
CRefice:filter_conn_by_pid
Jul 20, 2026
Merged

Use inodes for listing connections on Linux#224
panhania merged 2 commits into
google:masterfrom
CRefice:filter_conn_by_pid

Conversation

@CRefice

@CRefice CRefice commented Jul 6, 2026

Copy link
Copy Markdown
Collaborator

The current implementation of ospect's network connection listing functionality on Linux tries to read a process' open connections from procfs, for instance from /proc/<pid>/net/tcp. However, /proc/<pid>/net/tcp is effectively the same as /proc/net/tcp, meaning it lists all open connections on the system, whether they were opened by the process in question or not. This results in incorrect process attribution, and even worse, in all_connections() returning multiple copies of the results, one per active process on the system!

To fix this, this PR introduces a similar strategy to that used by the python psutil package which was used by the old GRR agent: parsing the connection's inode from /proc/net/, and matching it with the process' currently open file descriptors (from /proc/<pid>/fd), ignoring the result if there's no match.

This can still result in some duplicate results being returned, since for example, a process can open a socket and then fork, in which case the connection will be considered as "owned" by both parent and child. But in the general case, this will no longer result in hundreds of thousands of duplicate results.

Overall, the public interface of net.rs is not well suited to Linux, where there is no 1:1 ownership between a process and a network connection. Having a standalone function to list connections owned by a given process means we must scan /proc/net/ once for each process, which is not ideal for performance.
Changing that would require more extensive changes to the implementation for other platforms as well, so we can save it for a future improvement.

@CRefice
CRefice requested a review from panhania July 6, 2026 14:12
Comment thread crates/ospect/src/net.rs Outdated
Comment thread crates/ospect/src/net/linux/conn.rs Outdated
Comment thread crates/ospect/src/net/linux/conn.rs Outdated
Comment thread crates/ospect/src/net/linux/conn.rs Outdated
Comment thread crates/ospect/src/net/linux/conn.rs Outdated
Comment thread crates/ospect/src/net/linux/conn.rs Outdated
@CRefice
CRefice force-pushed the filter_conn_by_pid branch from 983f3da to bcc0c74 Compare July 20, 2026 11:21
@CRefice
CRefice requested a review from panhania July 20, 2026 11:26
@panhania panhania changed the title ospect/net: Filter network connections based on the process' open sockets on Linux. Use inodes for listing connections on Linux Jul 20, 2026
@panhania
panhania merged commit 0ca91c5 into google:master Jul 20, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants