aquasecurity / aquasecurity/tracee
Some network packets are not captured
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
Hi team. Looks that some igress/egress tcp packets are not capture for Kubernetes load balancer to pod traffic data path.
You can check it by installing onlineboutique demo app from microsoft.
```sh
helm upgrade --install onlineboutique oci://us-docker.pkg.dev/online-boutique-ci/charts/onlineboutique -n eshop --create-namespace
```
It contains frontend pod which is exposed to the internet via LoadBalancer. I'm using simple GKE cluster with DataPlane V2 (cilium).
I traced __cgroup_bpf_run_filter_skb kprobe with pwru running in separate tracee container and I can see my public IP xx.xx.xx.xx
```
0xffff89223a35b700 0 [ksoftirqd/0] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53658->10.72.0.13:8080(tcp) SYN|ECE|CWR
0xffff89223a35bd00 0 [ksoftirqd/0] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53658(tcp) SYN|ACK|ECE
0xffff89223af04400 1 [flb-pipeline] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53656->10.72.0.13:8080(tcp) ACK
0xffff89224649f400 1 [server] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53656->10.72.0.13:8080(tcp) PSH|ACK
0xffff8922509c9ee0 0 [server] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53656(tcp) PSH|ACK
0xffff89220397cc00 0 [ksoftirqd/0] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53658->10.72.0.13:8080(tcp) ACK
0 [server] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53656(tcp) PSH|ACK
0xffff89229598c8e0 0 [server] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53656(tcp) PSH|ACK
```
## Output of `tracee version`:
```
Tracee version: "v0.15.1"
```
## Output of `uname -a`:
```
5.15.0-1028-gke #33-Ubuntu SMP Mon Feb 20 01:54:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
```
Contributor guide
Research direction
Reproduce the report by installing the onlineboutique chart on a GKE cluster and tracing __cgroup_bpf_run_filter_skb with pwru, using the provided Tracee and kernel versions. Compare the observed ingress and egress TCP packets with Tracee's capture output; done means the missing load-balancer-to-pod packets are consistently captured or the limitation is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, linux
- Domain
- networking, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100