Packet loss handling for nfs/rpc protocols within Packetbeat needs work.
Open
Packetbeat
Team:Security-Linux Platform
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
Short term: Check sizes and header boundaries to safely ignore dropped packets or drop current connection tracking. Versus the current paradigm which is to simply append to the stream and ultimately leads to parsing errors.
Long term: Implement ebpf-based socket level tapping, thereby avoiding transport complications and reducing the volume of data needed for processing. Hopefully, leading lower potential for packet loss within Packetbeat.
Contributor guide
Assessment
This issue has not been assessed yet.