-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SIEM] [Auditbeat] system/socket: Fix UDP flows #13470
Conversation
This fixes a few problems with UDP: - IPv6/UDP unconnected support. - Lost packets in UDP due to using zero-destination address. - Added more tests
Pinging @elastic/siem |
Not available in Windows CI workers
@@ -321,7 +321,7 @@ var installKProbes = []helper.ProbeDef{ | |||
Probe: tracing.Probe{ | |||
Name: "udp_sendmsg_in", | |||
Address: "udp_sendmsg", | |||
Fetchargs: "sock={{.UDP_SENDMSG_SOCK}} size={{.UDP_SENDMSG_LEN}} laddr=+{{.INET_SOCK_LADDR}}({{.UDP_SENDMSG_SOCK}}):u32 lport=+{{.INET_SOCK_LPORT}}({{.UDP_SENDMSG_SOCK}}):u16 raddr=+{{.SOCKADDR_IN_ADDR}}(+0({{.UDP_SENDMSG_MSG}})):u32 rport=+{{.SOCKADDR_IN_PORT}}(+0({{.UDP_SENDMSG_MSG}})):u16", | |||
Fetchargs: "sock={{.UDP_SENDMSG_SOCK}} size={{.UDP_SENDMSG_LEN}} laddr=+{{.INET_SOCK_LADDR}}({{.UDP_SENDMSG_SOCK}}):u32 lport=+{{.INET_SOCK_LPORT}}({{.UDP_SENDMSG_SOCK}}):u16 raddr=+{{.SOCKADDR_IN_ADDR}}(+0({{.UDP_SENDMSG_MSG}})):u32 rport=+{{.SOCKADDR_IN_PORT}}(+0({{.UDP_SENDMSG_MSG}})):u16 altraddr=+{{.INET_SOCK_RADDR}}({{.UDP_SENDMSG_SOCK}}):u32 altrport=+{{.INET_SOCK_RPORT}}({{.UDP_SENDMSG_SOCK}}):u16", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In what cases are the alt addrs needed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sometimes, for connected sockets, the alt addresses are zero and the non-alt are populated.
This fixes a few problems with UDP: - IPv6/UDP unconnected support. - Lost packets in UDP due to using zero-destination address. - Added more tests (cherry picked from commit f0e2e20)
…tic#13513) This fixes a few problems with UDP: - IPv6/UDP unconnected support. - Lost packets in UDP due to using zero-destination address. - Added more tests (cherry picked from commit 7dd2735)
This fixes a few problems with UDP:
Added more tests.
Relates #13058