aquasecurity / aquasecurity/tracee

Some network packets are not captured

Open
#3,277 9 comments 0 reactions 0 assignees View on GitHub
area/capture area/network kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

Hi team. Looks that some igress/egress tcp packets are not capture for Kubernetes load balancer to pod traffic data path.

You can check it by installing onlineboutique demo app from microsoft.

```sh
helm upgrade --install onlineboutique oci://us-docker.pkg.dev/online-boutique-ci/charts/onlineboutique -n eshop --create-namespace
```

It contains frontend pod which is exposed to the internet via LoadBalancer. I'm using simple GKE cluster with DataPlane V2 (cilium).

I traced __cgroup_bpf_run_filter_skb kprobe with pwru running in separate tracee container and I can see my public IP xx.xx.xx.xx

```
0xffff89223a35b700 0 [ksoftirqd/0] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53658->10.72.0.13:8080(tcp) SYN|ECE|CWR
0xffff89223a35bd00 0 [ksoftirqd/0] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53658(tcp) SYN|ACK|ECE
0xffff89223af04400 1 [flb-pipeline] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53656->10.72.0.13:8080(tcp) ACK
0xffff89224649f400 1 [server] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53656->10.72.0.13:8080(tcp) PSH|ACK
0xffff8922509c9ee0 0 [server] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53656(tcp) PSH|ACK
0xffff89220397cc00 0 [ksoftirqd/0] __cgroup_bpf_run_filter_skb xx.xx.xx.xx:53658->10.72.0.13:8080(tcp) ACK
0 [server] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53656(tcp) PSH|ACK
0xffff89229598c8e0 0 [server] __cgroup_bpf_run_filter_skb 10.72.0.13:8080->xx.xx.xx.xx:53656(tcp) PSH|ACK
```

## Output of `tracee version`:

```
Tracee version: "v0.15.1"
```

## Output of `uname -a`:

```
5.15.0-1028-gke #33-Ubuntu SMP Mon Feb 20 01:54:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the report by installing the onlineboutique chart on a GKE cluster and tracing __cgroup_bpf_run_filter_skb with pwru, using the provided Tracee and kernel versions. Compare the observed ingress and egress TCP packets with Tracee's capture output; done means the missing load-balancer-to-pod packets are consistently captured or the limitation is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, linux
Domain
networking, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.