Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Packet loss handling for nfs/rpc protocols within Packetbeat needs work. #42344

Open
nicholasberlin opened this issue Jan 17, 2025 · 1 comment
Assignees
Labels
Packetbeat Team:Security-Linux Platform Linux Platform Team in Security Solution

Comments

@nicholasberlin
Copy link
Contributor

Short term: Check sizes and header boundaries to safely ignore dropped packets or drop current connection tracking. Versus the current paradigm which is to simply append to the stream and ultimately leads to parsing errors.

Long term: Implement ebpf-based socket level tapping, thereby avoiding transport complications and reducing the volume of data needed for processing. Hopefully, leading lower potential for packet loss within Packetbeat.

@nicholasberlin nicholasberlin added Packetbeat Team:Security-Linux Platform Linux Platform Team in Security Solution labels Jan 17, 2025
@nicholasberlin nicholasberlin self-assigned this Jan 17, 2025
@elasticmachine
Copy link
Collaborator

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Packetbeat Team:Security-Linux Platform Linux Platform Team in Security Solution
Projects
None yet
Development

No branches or pull requests

2 participants