aquasecurity / aquasecurity/tracee

Bogus packets generated by packet capture

Open
#4,087 0 comments 0 reactions 0 assignees View on GitHub
area/capture kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

When capturing network packets on an active system, bogus packets are generated. This only seems to happen when snaplen is set to max.

To reproduce the issue, first create some network activity. I found that running the following client-server python script generates enough traffic:

```python
# Server
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('127.0.0.1', 12345))
s.listen()
c, _ = s.accept()
while True:
c.recv(1024)
```

```python
# Client
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 12345))
while True:
s.send(b'hello'*100)
```

After that, run tracee as follows:

```bash
$ sudo dist/tracee -c network -c pcap:single -c pcap-snaplen:max
```

After a few seconds, stop tracee and open `/tmp/tracee/out/pcap/single.pcap` in Wireshark. Bogus packets should appear, for example:

![image](https://github.com/aquasecurity/tracee/assets/32914127/b47b3770-cae4-4c04-b2a4-768d444f875f)

As can be seen, the size is massive (64KB), the protocol field does not make sense and the addresses are bogus.

## Output of `tracee version`:

```
Tracee version: v0.21.0-rc-46-g940917f54
```

## Output of `uname -a`:

```
Linux ********** 6.1.21.2-microsoft-standard-WSL2 #1 SMP Sun Mar 17 10:40:08 IST 2024 x86_64 x86_64 x86_64 GNU/Linux
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the provided Python client-server script and `sudo dist/tracee -c network -c pcap:single -c pcap-snaplen:max`; inspect the packet-capture path that writes `/tmp/tracee/out/pcap/single.pcap`. Done means max-snaplen captures no bogus 64KB packets and Wireshark shows valid addresses and protocol fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux, python
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.