evilsocket / evilsocket/opensnitch
[Feature] Display bytes sent/received per process
- Dominant language
- Python
- Stars
- 14.1k
- Forks
- 665
- PR merge metrics
- No merged PRs in 30d
Description
There's some interest in knowing the amount of data sent/received per process so I've been working on this lately.
There'll be issues and doubts so let this issue serve as a way to group them together.
**How it works:**
Data sent or received is intercepted via eBPF and stored in a map by pid.
When a connection is destroyed, the collected data is sent to userspace, accumulated by process, and the partial bytes sent to the GUI (server). The entry is deleted from the eBPF map.
In order not to saturate the daemon, the bytes are accumulated on kernel space. Every 5s the counters are resetted and the collected stats sent to userspace.
Note: This information can also be obtained via [netlink](https://github.com/vishvananda/netlink/blob/4287122432b2d613ce6b283eab8ea1425d015c1b/socket_linux.go#L176), but as we only intercept new connections, we'd need to intercept connections destruction anyway.
On the GUI (server), the data is saved to the DB and displayed on the Applications tab:

**New features based on this one:**
- Allow to apply network quotas by process: Allow connections of a process until a limit, or drop connections when a process exceeds a limit.
* The PoC works, but as we only intercept new connections, the rule may be delayed (until a new connection is opened).
**TODOs:**
- [ ] Order by bytes numerically instead of alphabetically.
- [x] Allow to view the bytes, without grouping them.
- [x] Delete entries from the ebpf map that hasn't been deleted in a proper way (like when killing a process that had opened connections). Otherwise if the map becomes full, it won't accept new entries and we will miss statistics.
- [ ] Review if the hooked functions are the correct ones, or are there others that serve better for the task (tcp_cleanup_rbuf vs tcp_recvmsg?).
- [ ] Group bytes per connection
[18/09/2024] the branch with this feature working: https://github.com/evilsocket/opensnitch/tree/send-recv-bytes?tab=readme-ov-file
- Note: bytes are grouped per process, but that is not correct. We must group bytes per connection, to be able to know how many bytes were sent to what port, what IP, domain, etc... and then as we know the connections initiated by a process, we'll be able to display the bytes sent by a process.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.