pcaps

Documentation

Index

• Constants
• func GenerateInterface(event *trace.Event, t PcapType) (pcapgo.NgInterface, error)
• func PcapsEnabled(simple config.PcapsConfig) bool
• type ContainerContext
• type KubernetesContext
• type PacketContext
• type Pcap
  • func NewPcap(e *trace.Event, t PcapType) (*Pcap, error)
• type PcapCache
• type PcapOption
  • func GetPcapOptions(c config.PcapsConfig) PcapOption
• type PcapType
  • func (t *PcapType) String() string
• type Pcaps
  • func New(simple config.PcapsConfig, output *os.File) (*Pcaps, error)
  • func (p *Pcaps) Destroy() error
  • func (p *Pcaps) Write(event *trace.Event, payload []byte) error
• type ProcessContext

Constants

const AF_INET = 2

const AF_INET6 = 10

Functions

func GenerateInterface

func GenerateInterface(event *trace.Event, t PcapType) (pcapgo.NgInterface, error)

func PcapsEnabled

func PcapsEnabled(simple config.PcapsConfig) bool

PcapsEnabled checks if the simple config has any bool value set

Types

type ContainerContext

type ContainerContext struct {
	ID          string `json:"id,omitempty"`
	Name        string `json:"name,omitempty"`
	ImageName   string `json:"image,omitempty"`
	ImageDigest string `json:"imageDigest,omitempty"`
}

type KubernetesContext

type KubernetesContext struct {
	PodName      string `json:"podName,omitempty"`
	PodNamespace string `json:"podNamespace,omitempty"`
	PodUID       string `json:"podUID,omitempty"`
	PodSandbox   bool   `json:"podSandbox,omitempty"`
}

type PacketContext

type PacketContext struct {
	Version string `json:"version"`

	// Present for container, command and process captures
	Container  *ContainerContext  `json:"container,omitempty"`
	Kubernetes *KubernetesContext `json:"kubernetes,omitempty"`
	HostName   string             `json:"hostName,omitempty"`

	// Present for command and process captures
	ProcessName string `json:"processName,omitempty"`

	// Present for process captures
	Process *ProcessContext `json:"process,omitempty"`
}

This struct represents the context of a packet capture. Packet captures can be per process, command, container or a single capture, which affects the context info relevant to it. The context contains information that is supposed to be constant for the entire capture, although this may not always be the case. For example, if a process changes its name, this won't be reflected in the capture's context information.

type Pcap

type Pcap struct {
	// contains filtered or unexported fields
}

Pcap is a representation of a pcap file

func NewPcap

func NewPcap(e *trace.Event, t PcapType) (*Pcap, error)

type PcapCache

type PcapCache struct {
	// contains filtered or unexported fields
}

PcapCache is an intermediate LRU cache in between Pcap and Pcaps

type PcapOption

type PcapOption uint32

const (
	Filtered PcapOption = 0x1
)

func GetPcapOptions

func GetPcapOptions(c config.PcapsConfig) PcapOption

type PcapType

type PcapType uint

const (
	//
	// 1 (0001): process:   1 pcap file per process (default)
	// 2 (0010): container: 1 pcap file per container
	// 4 (0011): command:   1 pcap file per command
	// 8 (1000): single:    1 single pcap file for all
	//
	// or a combination:
	//
	// 3 (0011): process + container
	// 5 (0010): process + command
	// 6 (0110): container + command
	// 7 (0111): process + container + command
	//
	None      PcapType = 0x0
	Process   PcapType = 0x1
	Container PcapType = 0x2
	Command   PcapType = 0x4
	Single    PcapType = 0x8
)

func (*PcapType) String

func (t *PcapType) String() string

type Pcaps

type Pcaps struct {
	// contains filtered or unexported fields
}

Pcaps holds all Pcap for different PcapTypes

func New

func New(simple config.PcapsConfig, output *os.File) (*Pcaps, error)

func (*Pcaps) Destroy

func (p *Pcaps) Destroy() error

Destroy destroys all opened pcap files from all supported pcap types

func (*Pcaps) Write

func (p *Pcaps) Write(event *trace.Event, payload []byte) error

Write writes a packet to all opened pcap files from all supported pcap types

type ProcessContext

type ProcessContext struct {
	ThreadStartTime     int    `json:"threadStartTime"`
	ProcessID           int    `json:"processId"`
	CgroupID            uint   `json:"cgroupId"`
	ThreadID            int    `json:"threadId"`
	ParentProcessID     int    `json:"parentProcessId"`
	HostProcessID       int    `json:"hostProcessId"`
	HostThreadID        int    `json:"hostThreadId"`
	HostParentProcessID int    `json:"hostParentProcessId"`
	UserID              int    `json:"userId"`
	MountNS             int    `json:"mountNamespace"`
	PIDNS               int    `json:"pidNamespace"`
	Executable          string `json:"executable"`
}