socketinfo

Documentation

Index

• func HashTuple(protocol flow.FlowProtocol, srcAddr net.IP, srcPort int64, dstAddr net.IP, ...) string
• type ConnectionCache
  • func NewConnectionCache() *ConnectionCache
  • func (c *ConnectionCache) Get(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, ...) (interface{}, string)
  • func (c *ConnectionCache) Map(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, ...) (a *ProcessInfo, b *ProcessInfo)
  • func (c *ConnectionCache) MapTCP(srcAddr, dstAddr *net.TCPAddr) (a *ProcessInfo, b *ProcessInfo)
  • func (c *ConnectionCache) MapUDP(srcAddr, dstAddr *net.UDPAddr) (a *ProcessInfo, b *ProcessInfo)
  • func (c *ConnectionCache) Remove(protocol flow.FlowProtocol, srcAddr, dstAddr *net.TCPAddr)
  • func (c *ConnectionCache) Set(hash string, obj interface{})
• type ConnectionInfo
  • func (c *ConnectionInfo) Decode(obj interface{}) error
  • func (c *ConnectionInfo) Hash() string
• type ConnectionState
• type ProbeHandler
  • func (s *ProbeHandler) Init(ctx tp.Context, bundle *probe.Bundle) (probe.Handler, error)
• type ProcProbe
  • func NewProcProbe(ctx tp.Context) *ProcProbe
  • func (s *ProcProbe) MapTCP(srcAddr, dstAddr *net.TCPAddr) (src *ProcessInfo, dst *ProcessInfo)
  • func (s *ProcProbe) Start()
  • func (s *ProcProbe) Stop()
• type ProcessInfo

Functions

func HashTuple

func HashTuple(protocol flow.FlowProtocol, srcAddr net.IP, srcPort int64, dstAddr net.IP, dstPort int64) string

HashTuple computes a hash value for a connection 5 tuple

Types

type ConnectionCache

type ConnectionCache struct {
	*cache.Cache
}

ConnectionCache describes a cache of TCP connections

func NewConnectionCache

func NewConnectionCache() *ConnectionCache

NewConnectionCache returns a new connection cache

func (*ConnectionCache) Get

func (c *ConnectionCache) Get(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, dstPort int) (interface{}, string)

Get returns the connection for a pair of TCP addresses

func (*ConnectionCache) Map

func (c *ConnectionCache) Map(protocol flow.FlowProtocol, srcIP net.IP, srcPort int, dstIP net.IP, dstPort int) (a *ProcessInfo, b *ProcessInfo)

Map a flow to a process

func (*ConnectionCache) MapTCP

func (c *ConnectionCache) MapTCP(srcAddr, dstAddr *net.TCPAddr) (a *ProcessInfo, b *ProcessInfo)

MapTCP returns the sending and receiving processes for a pair of TCP addresses

func (*ConnectionCache) MapUDP

func (c *ConnectionCache) MapUDP(srcAddr, dstAddr *net.UDPAddr) (a *ProcessInfo, b *ProcessInfo)

MapUDP returns the sending and receiving processes for a pair of UDP addresses

func (*ConnectionCache) Remove

func (c *ConnectionCache) Remove(protocol flow.FlowProtocol, srcAddr, dstAddr *net.TCPAddr)

Remove the entry for a pair of TCP addresses

func (*ConnectionCache) Set

func (c *ConnectionCache) Set(hash string, obj interface{})

Set maps a hash to a connection

type ConnectionInfo

type ConnectionInfo struct {
	ProcessInfo   `mapstructure:",squash"`
	LocalAddress  string
	LocalPort     int64
	RemoteAddress string
	RemotePort    int64
	Protocol      flow.FlowProtocol
	State         ConnectionState
}

ConnectionInfo describes a connection and its corresponding process easyjson:json gendecoder

func (*ConnectionInfo) Decode

func (c *ConnectionInfo) Decode(obj interface{}) error

Decode an JSON object to connection info

func (*ConnectionInfo) Hash

func (c *ConnectionInfo) Hash() string

Hash computes the hash of a connection

type ConnectionState

type ConnectionState string

ConnectionState describes the state of a connection

type ProbeHandler

type ProbeHandler struct {
	probe.Handler
}

ProbeHandler describes a probe that collects active connections

func (*ProbeHandler) Init

func (s *ProbeHandler) Init(ctx tp.Context, bundle *probe.Bundle) (probe.Handler, error)

Init initializes a new SocketInfo Probe

type ProcProbe

type ProcProbe struct {
	Ctx tp.Context
	// contains filtered or unexported fields
}

ProcProbe describes a probe that collects active connections

func NewProcProbe

func NewProcProbe(ctx tp.Context) *ProcProbe

NewProcProbe create a new socket info probe

func (*ProcProbe) MapTCP

func (s *ProcProbe) MapTCP(srcAddr, dstAddr *net.TCPAddr) (src *ProcessInfo, dst *ProcessInfo)

MapTCP returns the sending and receiving processes for a pair of TCP addresses When using /proc, if the connection was not found at the first try, we scan /proc again

func (*ProcProbe) Start

func (s *ProcProbe) Start()

Start the socket info probe

func (*ProcProbe) Stop

func (s *ProcProbe) Stop()

Stop the socket info probe

type ProcessInfo

type ProcessInfo struct {
	Process string
	Pid     int64
	Name    string
}

ProcessInfo describes the information of a running process