evilsocket / evilsocket/opensnitch

[Feature] Display bytes sent/received per process

Open
#1,081 2 comments 11 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

There's some interest in knowing the amount of data sent/received per process so I've been working on this lately.
There'll be issues and doubts so let this issue serve as a way to group them together.

**How it works:**

Data sent or received is intercepted via eBPF and stored in a map by pid.
When a connection is destroyed, the collected data is sent to userspace, accumulated by process, and the partial bytes sent to the GUI (server). The entry is deleted from the eBPF map.

In order not to saturate the daemon, the bytes are accumulated on kernel space. Every 5s the counters are resetted and the collected stats sent to userspace.

Note: This information can also be obtained via [netlink](https://github.com/vishvananda/netlink/blob/4287122432b2d613ce6b283eab8ea1425d015c1b/socket_linux.go#L176), but as we only intercept new connections, we'd need to intercept connections destruction anyway.

On the GUI (server), the data is saved to the DB and displayed on the Applications tab:

![](https://github.com/evilsocket/opensnitch/assets/2742953/b9f29bf4-4b22-4aa5-adf5-0fc481b978fe)

**New features based on this one:**
- Allow to apply network quotas by process: Allow connections of a process until a limit, or drop connections when a process exceeds a limit.
* The PoC works, but as we only intercept new connections, the rule may be delayed (until a new connection is opened).

**TODOs:**
- [ ] Order by bytes numerically instead of alphabetically.
- [x] Allow to view the bytes, without grouping them.
- [x] Delete entries from the ebpf map that hasn't been deleted in a proper way (like when killing a process that had opened connections). Otherwise if the map becomes full, it won't accept new entries and we will miss statistics.
- [ ] Review if the hooked functions are the correct ones, or are there others that serve better for the task (tcp_cleanup_rbuf vs tcp_recvmsg?).
- [ ] Group bytes per connection

[18/09/2024] the branch with this feature working: https://github.com/evilsocket/opensnitch/tree/send-recv-bytes?tab=readme-ov-file
- Note: bytes are grouped per process, but that is not correct. We must group bytes per connection, to be able to know how many bytes were sent to what port, what IP, domain, etc... and then as we know the connections initiated by a process, we'll be able to display the bytes sent by a process.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.