elastic / elastic/ebpf

Support for DNS monitoring

Open
#203 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C
Stars
86
Forks
11
Avg merge
15d 19h
Merged PRs (30d)
1

Description

### Impact

High

### Epic/Meta Issue

_No response_

### Planned Version

None

### Description

So, we want Linux DNS support in endpoint, and part of that is going to be done here in ebpf. I'm making a lot of assumptions here, so feel free to correct me if there's something I'm missing. This is just a preliminary list of all the parts we'll need for DNS monitoring in this repo:

- [ ] DNS over UDP. Can be done via some combination of `ip[4,6]_datagram_connect`, `udp_destruct_sock` and others. Similar enough to existing network probes. The remaining question: do we want the _probe_ to filter by port 53 here in ebpf, or should upstream components in endpoint do that?
- [ ] DNS over TCP. Also uses port 53. Do we want to support this?
- [ ] DNS over TLS. Uses port 853. Do we want to support his?
- [ ] DNS over HTTPS. Uses the standard HTTPS port. Is there anything we can even do for this? Any kind of https decryption or list matching of DoH servers will probably be done elsewhere.
- [ ] Deep packet inspection. Do we care about people running DNS queries over non-standard ports? Should we start sniffing traffic over other ports looking for anything that looks like a DNS request/response?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.