socketinfo

Documentation

Index

• func HashTuple(protocol flow.FlowProtocol, srcAddr net.IP, srcPort int64, dstAddr net.IP, ...) string
• type ConnectionCache
  • func NewConnectionCache() *ConnectionCache
  • func (c *ConnectionCache) Get(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, ...) (interface{}, string)
  • func (c *ConnectionCache) Map(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, ...) (a *ProcessInfo, b *ProcessInfo)
  • func (c *ConnectionCache) MapTCP(srcAddr, dstAddr *net.TCPAddr) (a *ProcessInfo, b *ProcessInfo)
  • func (c *ConnectionCache) MapUDP(srcAddr, dstAddr *net.UDPAddr) (a *ProcessInfo, b *ProcessInfo)
  • func (c *ConnectionCache) Remove(protocol flow.FlowProtocol, srcAddr, dstAddr *net.TCPAddr)
  • func (c *ConnectionCache) Set(hash string, obj interface{})
• type ConnectionInfo
  • func (c *ConnectionInfo) Decode(obj interface{}) error
  • func (c *ConnectionInfo) GetField(field string) (interface{}, error)
  • func (c *ConnectionInfo) GetFieldInt64(name string) (int64, error)
  • func (c *ConnectionInfo) GetFieldString(name string) (string, error)
  • func (c *ConnectionInfo) Hash() string
• type ConnectionState
• type ProcSocketInfoProbe
  • func NewProcSocketInfoProbe(g *graph.Graph, host *graph.Node) *ProcSocketInfoProbe
  • func NewSocketInfoProbe(g *graph.Graph, host *graph.Node) *ProcSocketInfoProbe
  • func (s *ProcSocketInfoProbe) MapTCP(srcAddr, dstAddr *net.TCPAddr) (src *ProcessInfo, dst *ProcessInfo)
  • func (s *ProcSocketInfoProbe) Start()
  • func (s *ProcSocketInfoProbe) Stop()
• type ProcessInfo

Functions

func HashTuple

func HashTuple(protocol flow.FlowProtocol, srcAddr net.IP, srcPort int64, dstAddr net.IP, dstPort int64) string

HashTuple computes a hash value for a connection 5 tuple

Types

type ConnectionCache

type ConnectionCache struct {
	*cache.Cache
}

ConnectionCache describes a cache of TCP connections

func NewConnectionCache

func NewConnectionCache() *ConnectionCache

NewConnectionCache returns a new connection cache

func (*ConnectionCache) Get

func (c *ConnectionCache) Get(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, dstPort int) (interface{}, string)

Get returns the connection for a pair of TCP addresses

func (*ConnectionCache) Map

func (c *ConnectionCache) Map(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, dstPort int) (a *ProcessInfo, b *ProcessInfo)

func (*ConnectionCache) MapTCP

func (c *ConnectionCache) MapTCP(srcAddr, dstAddr *net.TCPAddr) (a *ProcessInfo, b *ProcessInfo)

MapTCP returns the sending and receiving processes for a pair of TCP addresses

func (*ConnectionCache) MapUDP

func (c *ConnectionCache) MapUDP(srcAddr, dstAddr *net.UDPAddr) (a *ProcessInfo, b *ProcessInfo)

MapTCP returns the sending and receiving processes for a pair of TCP addresses

func (*ConnectionCache) Remove

func (c *ConnectionCache) Remove(protocol flow.FlowProtocol, srcAddr, dstAddr *net.TCPAddr)

Remove the entry for a pair of TCP addresses

func (*ConnectionCache) Set

func (c *ConnectionCache) Set(hash string, obj interface{})

Set maps a hash to a connection

type ConnectionInfo

type ConnectionInfo struct {
	ProcessInfo   `mapstructure:",squash"`
	LocalAddress  string
	LocalPort     int64
	RemoteAddress string
	RemotePort    int64
	Protocol      flow.FlowProtocol
	State         ConnectionState
}

ConnectionInfo describes a connection and its corresponding process easyjson:json

func (*ConnectionInfo) Decode

func (c *ConnectionInfo) Decode(obj interface{}) error

func (*ConnectionInfo) GetField

func (c *ConnectionInfo) GetField(field string) (interface{}, error)

GetField returns the value of a field

func (*ConnectionInfo) GetFieldInt64

func (c *ConnectionInfo) GetFieldInt64(name string) (int64, error)

GetFieldInt64 returns the value of a connection field of type int64

func (*ConnectionInfo) GetFieldString

func (c *ConnectionInfo) GetFieldString(name string) (string, error)

GetFieldInt64 returns the value of a connection field of type string

func (*ConnectionInfo) Hash

func (c *ConnectionInfo) Hash() string

Hash computes the hash of a connection

type ConnectionState

type ConnectionState string

ConnectionState describes the state of a connection

type ProcSocketInfoProbe

type ProcSocketInfoProbe struct {
	// contains filtered or unexported fields
}

ProcSocketInfoProbe describes a probe that collects active connections

func NewProcSocketInfoProbe

func NewProcSocketInfoProbe(g *graph.Graph, host *graph.Node) *ProcSocketInfoProbe

NewProcSocketInfoProbe create a new socket info probe

func NewSocketInfoProbe

func NewSocketInfoProbe(g *graph.Graph, host *graph.Node) *ProcSocketInfoProbe

NewSocketInfoProbe create a new socket info probe

func (*ProcSocketInfoProbe) MapTCP

func (s *ProcSocketInfoProbe) MapTCP(srcAddr, dstAddr *net.TCPAddr) (src *ProcessInfo, dst *ProcessInfo)

MapTCP returns the sending and receiving processes for a pair of TCP addresses When using /proc, if the connection was not found at the first try, we scan /proc again

func (*ProcSocketInfoProbe) Start

func (s *ProcSocketInfoProbe) Start()

Start the socket info probe

func (*ProcSocketInfoProbe) Stop

func (s *ProcSocketInfoProbe) Stop()

Stop the socket info probe

type ProcessInfo

type ProcessInfo struct {
	Process string
	Pid     int64
	Name    string
}

ProcessInfo describes the information of a running process