Duplicated packets when listening on loopback interface

[awelzel]

When monitoring lo using AF_PACKET apparently all packets are seen twice: Once as incoming and once as outgoing packets.

I ran into this monitoring local HTTP traffic using curl/nginx just now and being a bit surprised by the history field.

$ docker run -d --name nginx --network=host nginx
$ curl http://localhost:80

The zeek -Ci lo LogAscii::use_json=T invocation produces the following conn.log:

{
  "ts": 1680017486.109133,
  "uid": "CEZrEO3CIBpBDh3IQc",
  "id.orig_h": "::1",
  "id.orig_p": 58810,
  "id.resp_h": "::1",
  "id.resp_p": 80,
  "proto": "tcp",
  "service": "http",
  "duration": 0.0011889934539794922,
  "orig_bytes": 73,
  "resp_bytes": 853,
  "conn_state": "SF",
  "local_orig": true,
  "local_resp": true,
  "missed_bytes": 0,
  "history": "ShADadFf",
  "orig_pkts": 7,
  "orig_ip_bytes": 585,
  "resp_pkts": 5,
  "resp_ip_bytes": 1221
}

The zeek -Ci af_packet::lo LogAscii::use_json=T invocation instead twice as many packets and bytes and retransmissions in the history:

{
  "ts": 1680017535.588589,
  "uid": "CQ4XZJ3ISHNAL7p2oe",
  "id.orig_h": "::1",
  "id.orig_p": 58824,
  "id.resp_h": "::1",
  "id.resp_p": 80,
  "proto": "tcp",
  "service": "http",
  "duration": 0.0012431144714355469,
  "orig_bytes": 73,
  "resp_bytes": 853,
  "conn_state": "SF",
  "local_orig": true,
  "local_resp": true,
  "missed_bytes": 0,
  "history": "ShADTadtFf",
  "orig_pkts": 14,
  "orig_ip_bytes": 1170,
  "resp_pkts": 10,
  "resp_ip_bytes": 2442
}

The libpcap code has the following tweak to remove one direction of loopback interface packets:

https://github.com/the-tcpdump-group/libpcap/blob/244080f5f9d4f17340041d1f5a3efd278ff08d7b/pcap-linux.c#L1173-L1181

Found through here.

It would be nice if the packet source would do the same. Monitoring lo might not be a common case, but not overly exotic either.