Process misattribution in system/socket dataset
Open
bug
Team:Security-Service Integrations
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
Related to a SDH.
Sometimes the TCP connections are assigned an incorrect process, for example `sed` having made a TCP connection.
This was observed in 8.12.2 with debian9, more information on the SDH.
It took me awhile to reproduce but the following works:
In one session:
```
while true;do make clean-all;make -j4;sleep 0.1;done
```
Another:
```
while true; do sudo apt-get -y purge gnome;sudo apt-get -y autoremove;sudo apt-get -y clean;sudo apt-get -y install gnome;done
```
Here we see that one SSH session was incorrectly assigned to `cc`:

More information in the SDH.
Contributor guide
Assessment
This issue has not been assessed yet.