mozillazg/ptcpdumpАнализатор пакетов на основе eBPF, который захватывает сетевой трафик с автоматическим аннотированием метаданных процессов, контейнеров и подов Kubernetes, поддерживая фильтрацию, совместимую с tcpdump, и вывод в формате PcapNG.
%20e2e)
%20e2e)
ptcpdump — это совместимый с tcpdump анализатор пакетов на основе eBPF, автоматически аннотирующий пакеты метаданными процесса/контейнера/пода, когда это возможно. Вдохновлён jschwinger233/skbdump.
--pid (процесс), --pname (имя процесса), --container-id (контейнер), --pod-name (под).-i, -w, -c, -s, -n, -C, -W, -A и др.).pcap-filter(7), как в tcpdump.Вы можете загрузить статически скомпилированный исполняемый файл для x86_64 и arm64 со страницы релизов.
Ядро Linux >= 5.2 (скомпилировано с поддержкой BPF и BTF).
ptcpdump опционально требует debugfs. Он должен быть смонтирован в /sys/kernel/debug.
В случае, если папка пуста, её можно смонтировать командой:
mount -t debugfs none /sys/kernel/debug
Требуется следующая конфигурация ядра. Сборка в виде модулей также возможна.
Фильтрация как в tcpdump:
sudo ptcpdump -i eth0 tcp
sudo ptcpdump -i eth0 -A -s 0 -n -v tcp and port 80 and host 10.10.1.1
sudo ptcpdump -i any -s 0 -n -v -C 100MB -W 3 -w test.pcapng 'tcp and port 80 and host 10.10.1.1'
sudo ptcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'
Несколько интерфейсов:
sudo ptcpdump -i eth0 -i lo
Фильтрация по процессу или пользователю:
sudo ptcpdump -i any --pid 1234 --pid 233 -f
sudo ptcpdump -i any --pname curl
sudo ptcpdump -i any --uid 1000
Захват процесса через запуск целевой программы:
sudo ptcpdump -i any -- curl ubuntu.com
Фильтрация по контейнеру или поду:
sudo ptcpdump -i any --container-id 36f0310403b1
sudo ptcpdump -i any --container-name test
sudo ptcpdump -i any --pod-name test.default
Сохранение данных в формате PcapNG:
sudo ptcpdump -i any -w demo.pcapng
sudo ptcpdump -i any -w - port 80 | tcpdump -n -r -
sudo ptcpdump -i any -w - port 80 | tshark -r -
Захват интерфейсов в других сетевых пространствах имён:
sudo ptcpdump -i lo --netns /run/netns/foo --netns /run/netns/bar
sudo ptcpdump -i any --netns /run/netns/foobar
sudo ptcpdump -i any --netns /proc/26/ns/net
По умолчанию:
09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0, ParentProc [python3.834381], Container [test], Pod [test.default]
09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0, ParentProc [python3.834381], Container [test], Pod [test.default]
С -q:
09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
С -v:
13:44:41.529003 eth0 In IP (tos 0x4, ttl 45, id 45428, offset 0, flags [DF], proto TCP (6), length 52)
139.178.84.217.443 > 172.19.0.2.42606: Flags [.], cksum 0x5284, seq 3173118145, ack 1385712707, win 118, options [nop,nop,TS val 134560683 ecr 1627716996], length 0
Process (pid 553587, cmd /usr/bin/wget, args wget kernel.org)
User (uid 1000)
ParentProc (pid 553296, cmd /bin/sh, args sh)
Container (name test, id d9028334568bf75a5a084963a8f98f78c56bba7f45f823b3780a135b71b91e95, image docker.io/library/alpine:3.18, labels {"io.cri-containerd.kind":"container","io.kubernetes.container.name":"test","io.kubernetes.pod.name":"test","io.kubernetes.pod.namespace":"default","io.kubernetes.pod.uid":"9e4bc54b-de48-4b1c-8b9e-54709f67ed0c"})
Pod (name test, namespace default, UID 9e4bc54b-de48-4b1c-8b9e-54709f67ed0c, labels {"run":"test"}, annotations {"kubernetes.io/config.seen":"2024-07-21T12:41:00.460249620Z","kubernetes.io/config.source":"api"})
Использование --context для ограничения контекста, включаемого в вывод:
# --context=process
09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0
# -v --context=process
13:44:41.529003 eth0 In IP (tos 0x4, ttl 45, id 45428, offset 0, flags [DF], proto TCP (6), length 52)
139.178.84.217.443 > 172.19.0.2.42606: Flags [.], cksum 0x5284, seq 3173118145, ack 1385712707, win 118, options [nop,nop,TS val 134560683 ecr 1627716996], length 0
Process (pid 553587, cmd /usr/bin/wget, args wget kernel.org)
# -v --context=process,parentproc,container,pod
# или -v --context=process --context=parentproc --context=container --context=pod
13:44:41.529003 eth0 In IP (tos 0x4, ttl 45, id 45428, offset 0, flags [DF], proto TCP (6), length 52)
139.178.84.217.443 > 172.19.0.2.42606: Flags [.], cksum 0x5284, seq 3173118145, ack 1385712707, win 118, options [nop,nop,TS val 134560683 ecr 1627716996], length 0
Process (pid 553587, cmd /usr/bin/wget, args wget kernel.org)
ParentProc (pid 553296, cmd /bin/sh, args sh)
Container (name test, id d9028334568bf75a5a084963a8f98f78c56bba7f45f823b3780a135b71b91e95, image docker.io/library/alpine:3.18, labels {"io.cri-containerd.kind":"container","io.kubernetes.container.name":"test","io.kubernetes.pod.name":"test","io.kubernetes.pod.namespace":"default","io.kubernetes.pod.uid":"9e4bc54b-de48-4b1c-8b9e-54709f67ed0c"})
Pod (name test, namespace default, UID 9e4bc54b-de48-4b1c-8b9e-54709f67ed0c, labels {"run":"test"}, annotations {"kubernetes.io/config.seen":"2024-07-21T12:41:00.460249620Z","kubernetes.io/config.source":"api"})
С -A:
14:44:34.457504 ens33 curl.205562 Out IP 10.0.2.15.39984 > 139.178.84.217.80: Flags [P.], seq 2722472188:2722472262, ack 892036871, win 64240, length 74, ParentProc [bash.180205]
E..r.,@[email protected].
.....T..0.P.E..5+g.P.......GET / HTTP/1.1
Host: kernel.org
User-Agent: curl/7.81.0
Accept: */*
С -x:
14:44:34.457504 ens33 curl.205562 Out IP 10.0.2.15.39984 > 139.178.84.217.80: Flags [P.], seq 2722472188:2722472262, ack 892036871, win 64240, length 74, ParentProc [bash.180205]
0x0000: 4500 0072 de2c 4000 4006 6fbf 0a00 020f
0x0010: 8bb2 54d9 9c30 0050 a245 a0fc 352b 6707
0x0020: 5018 faf0 ecfe 0000 4745 5420 2f20 4854
0x0030: 5450 2f31 2e31 0d0a 486f 7374 3a20 6b65
0x0040: 726e 656c 2e6f 7267 0d0a 5573 6572 2d41
0x0050: 6765 6e74 3a20 6375 726c 2f37 2e38 312e
0x0060: 300d 0a41 6363 6570 743a 202a 2f2a 0d0a
0x0070: 0d0a
С -X:
14:44:34.457504 ens33 curl.205562 Out IP 10.0.2.15.39984 > 139.178.84.217.80: Flags [P.], seq 2722472188:2722472262, ack 892036871, win 64240, length 74, ParentProc [bash.180205]
0x0000: 4500 0072 de2c 4000 4006 6fbf 0a00 020f E..r.,@[email protected].....
0x0010: 8bb2 54d9 9c30 0050 a245 a0fc 352b 6707 ..T..0.P.E..5+g.
0x0020: 5018 faf0 ecfe 0000 4745 5420 2f20 4854 P.......GET / HT
0x0030: 5450 2f31 2e31 0d0a 486f 7374 3a20 6b65 TP/1.1..Host: ke
0x0040: 726e 656c 2e6f 7267 0d0a 5573 6572 2d41 rnel.org..User-A
0x0050: 6765 6e74 3a20 6375 726c 2f37 2e38 312e gent: curl/7.81.
0x0060: 300d 0a41 6363 6570 743a 202a 2f2a 0d0a 0..Accept: */*..
0x0070: 0d0a ..
Образы Docker для ptcpdump публикуются по адресу https://quay.io/repository/ptcpdump/ptcpdump.
docker run --privileged --rm -t --net=host --pid=host \
-v /sys/fs/cgroup:/sys/fs/cgroup:ro \
-v /var/run:/var/run:ro \
-v /run:/run:ro \
quay.io/ptcpdump/ptcpdump:latest ptcpdump -i any -c 2 tcp
ptcpdump поддерживает указание конкретной технологии eBPF для захвата пакетов через флаг --backend.
Если флаг не указан, по умолчанию используется tc.
curl http://1.1.1.1 на хосте:--backend tc:
$ sudo ptcpdump -i any --backend tc host 1.1.1.1
12:11:28.009276 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [S], seq 615672474, win 64240, options [mss 1460,sackOK,TS val 2168208063 ecr 0,nop,wscale 7], length 0, ParentProc [bash.321004]
12:11:28.113779 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [S.], seq 1810787293, ack 615672475, win 64240, options [mss 1460], length 0, ParentProc [bash.321004]
12:11:28.113852 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672475, ack 1810787294, win 64240, length 0, ParentProc [bash.321004]
12:11:28.114216 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [P.], seq 615672475:615672545, ack 1810787294, win 64240, length 70, ParentProc [bash.321004]
12:11:28.115383 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787294, ack 615672545, win 64240, length 0, ParentProc [bash.321004]
12:11:28.534486 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [P.], seq 1810787294:1810787680, ack 615672545, win 64240, length 386, ParentProc [bash.321004]
12:11:28.534751 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672545, ack 1810787680, win 63854, length 0, ParentProc [bash.321004]
12:11:28.536982 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [F.], seq 615672545, ack 1810787680, win 63854, length 0, ParentProc [bash.321004]
12:11:28.538160 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787680, ack 615672546, win 64239, length 0, ParentProc [bash.321004]
12:11:28.642291 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [FP.], seq 1810787680, ack 615672546, win 64239, length 0, ParentProc [bash.321004]
12:11:28.642511 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672546, ack 1810787681, win 63854, length 0, ParentProc [bash.321004]
Usage:
ptcpdump [flags] [expression] [-- command [args]]
Examples:
sudo ptcpdump -i any tcp
sudo ptcpdump -i eth0 -i lo
sudo ptcpdump -i eth0 --pid 1234 port 80 and host 10.10.1.1
sudo ptcpdump -i any --pname curl -A
sudo ptcpdump -i any --container-id 36f0310403b1
sudo ptcpdump -i any --container-name test
sudo ptcpdump -i any -- curl ubuntu.com
sudo ptcpdump -i any -w ptcpdump.pcapng
sudo ptcpdump -i any -w - | tcpdump -n -r -
sudo ptcpdump -i any -w - | tshark -r -
ptcpdump -r ptcpdump.pcapng
Expression: see "man 7 pcap-filter"
Flags:
-S, --absolute-tcp-sequence-numbers Print absolute, rather than relative, TCP sequence numbers.
--backend string Specify the backend to use for capturing packets. Possible values are "tc", "cgroup-skb", "tp-btf" and "socket-filter" (default "tc")
--container-id string Filter by container id (only TCP and UDP packets are supported)
--container-name string Filter by container name (only TCP and UDP packets are supported)
--containerd-address string Address of containerd service (default "/run/containerd/containerd.sock")
--context strings Specify which context information to include in the output (default [process,thread,parentproc,user,container,pod])
--count Print only on stdout the packet count when reading capture file instead of parsing/printing the packets
--cri-runtime-address string Address of CRI container runtime service (default: uses in order the first successful one of [/var/run/dockershim.sock, /var/run/cri-dockerd.sock, /run/crio/crio.sock, /run/containerd/containerd.sock])
--delay-before-handle-packet-events duration Delay some durations before handle packet events
-Q, --direction string Choose send/receive direction for which packets should be captured. Possible values are 'in', 'out' and 'inout' (default "inout")
--disable-reverse-match Disable reverse match for TCP and UDP packets.
--docker-address string Address of Docker Engine service (default "/var/run/docker.sock")
--embed-keylog-to-pcapng -- CMD [ARGS] Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
--event-chan-size uint Size of event chan (default 20)
--exec-events-worker-number uint Number of worker to handle exec events (default 50)
-F, --expression-file string Use file as input for the filter expression. An additional expression given on the command line is ignored.
-W, --file-count uint Used in conjunction with the -C option, this will limit the number of files created to the specified number, and begin overwriting files from the beginning, thus creating a 'rotating' buffer.
-C, --file-size fileSize Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number after it, starting at 1 and continuing upward.
-f, --follow-forks Trace child processes as they are created by currently traced processes when filter by process
-h, --help help for ptcpdump
-i, --interface strings Interfaces to capture (default [lo])
--kernel-btf string specify kernel BTF file (default: uses in order the first successful one of [/sys/kernel/btf/vmlinux, /var/lib/ptcpdump/btf/vmlinux, /var/lib/ptcpdump/btf/vmlinux-$(uname -r), /var/lib/ptcpdump/btf/$(uname -r).btf, download BTF file from https://mirrors.openanolis.cn/coolbpf/btf/ and https://github.com/aquasecurity/btfhub-archive/]
-D, --list-interfaces Print the list of the network interfaces available on the system
--log-level string Set the logging level ("debug", "info", "warn", "error", "fatal") (default "warn")
--micro Shorthands for --time-stamp-precision=micro
--nano Shorthands for --time-stamp-precision=nano
--netns strings Path to an network namespace file or name (default [/proc/self/ns/net])
-n, --no-convert-addr count Don't convert addresses (i.e., host addresses, port numbers, etc.) to names
-#, --number Print an optional packet number at the beginning of the line
--oneline Print parsed packet output in a single line
--pid uints Filter by process IDs (only TCP and UDP packets are supported) (default [])
--pname string Filter by process name (only TCP and UDP packets are supported)
--pod-name string Filter by pod name (format: NAME.NAMESPACE, only TCP and UDP packets are supported)
--print Print parsed packet output, even if the raw packets are being saved to a file with the -w flag
-A, --print-data-in-ascii Print each packet (minus its link level header) in ASCII
-x, --print-data-in-hex count When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex
-X, --print-data-in-hex-ascii count When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex and ASCII
-t, --print-timestamp count control the format of the timestamp printed in the output
-q, --quiet Quiet output. Print less protocol information so output lines are shorter
-r, --read-file string Read packets from file (which was created with the -w option). e.g. ptcpdump.pcapng
-c, --receive-count uint Exit after receiving count packets
-s, --snapshot-length uint32 Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes (default 262144)
--time-stamp-precision string When capturing, set the time stamp precision for the capture to the format (default "micro")
--uid uints Filter by user IDs (only TCP and UDP packets are supported) (default [])
-v, --verbose count When parsing and printing, produce (slightly more) verbose output
--version Print the ptcpdump and libpcap version strings and exit
-w, --write-file string Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is '-'. e.g. ptcpdump.pcapng
--write-keylog-file -- CMD [ARGS] Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
|---------------------------------------------------|---------|--------------------------| | expression | ✅ | ✅ | | -i interface, --interface=interface | ✅ | ✅ | | -w x.pcapng | ✅ | ✅ (с информацией о процессе) | | -w x.pcap | ✅ | ✅ (без информации о процессе) | | -w - | ✅ | ✅ | | -r x.pcapng, -r x.pcap | ✅ | ✅ | | -r - | ✅ | ✅ | | --pid process_id | | ✅ | | --pname process_name | | ✅ | | --uid user_id | | ✅ | | --container-id container_id | | ✅ | | --container-name container_name | | ✅ | | --pod-name pod_name.namespace | | ✅ | | -f, --follow-forks | | ✅ | | -- command [args] | | ✅ | | --netns path_to_net_ns | | ✅ | | --print | ✅ | ✅ | | -A | ✅ | ✅ | | -B bufer_size, --buffer-size=buffer_size | ✅ | | | -c count | ✅ | ✅ | | --count | ✅ | ✅ | | -C *file_size | ✅ | ✅ | | -d | ✅ | | | -dd | ✅ | | | -ddd | ✅ | | | -D, --list-interfaces | ✅ | ✅ | | -e | ✅ | | | -f | ✅ | ⛔ | | -F file | ✅ | ✅ | | -G rotate_seconds | ✅ | | | -h, --help | ✅ | ✅ | | -H | ✅ | | | -I, --monitor-mode | ✅ | | | --immediate-mode | ✅ | | | -j , --time-stamp-type= | ✅ | | | --time-stamp-precision= | ✅ | ✅ | | -J, --list-time-stamp-types | ✅ | | | --micro | ✅ | ✅ | | --nano | ✅ | ✅ | | -K, --dont-verify-checksums | ✅ | | | -l | ✅ | | | -L, --list-data-link-types | ✅ | | | -m | ✅ | | | -M | ✅ | | | -n | ✅ | ✅ | | -N | ✅ | | | -#, --number | ✅ | ✅ | | -O, --no-optimize | ✅ | | | -p, --no-promiscuous-mode | ✅ | ⛔ | | -q | ✅ | ✅ | | -Q , --direction= | ✅ | ✅ | | -S, --absolute-tcp-sequence-numbers | ✅ | ✅ | | -s , --snapshot-length= | ✅ | ✅ | | -T | ✅ | | | -t | ✅ | ✅ | | -tt | ✅ | ✅ | | -ttt | ✅ | ✅ | | -tttt | ✅ | ✅ | | -ttttt | ✅ | ✅ | | -u | ✅ | | | -U, --packet-buffered | ✅ | | | -y , --linktype= | ✅ | | | -v | ✅ | ✅ | | -vv | ✅ | ⭕ | | -vvv | ✅ | ⭕ | | -V | ✅ | | | --version | ✅ | ✅ | | -W | ✅ | ✅ | | -x | ✅ | ✅ | | -xx | ✅ | ✅ | | -X | ✅ | ✅ | | -XX | ✅ | ✅ | | -z | ✅ | | | -Z , --relinquish-privileges= | ✅ | |
Убедитесь, что в вашей системе установлены следующие зависимости:
В системах Debian/Ubuntu большинство из них можно установить командой:
sudo apt-get update
sudo apt-get install -y build-essential clang llvm bison flex \
make autoconf libelf-dev
Сборка ptcpdump включает два основных этапа: генерация байт-кода eBPF
(опционально, если вы не изменяете код eBPF) и компиляция приложения на Go.
На этом этапе компилируется C-код eBPF из каталога bpf/
в байт-код для нескольких целевых архитектур (amd64, arm64, arm).
Сгенерированный байт-код затем встраивается в финальный исполняемый файл ptcpdump на Go.
Этот шаг требуется только в том случае, если вы изменяете исходный код eBPF или
если предварительно сгенерированные файлы отсутствуют.
Нативная сборка: Требует локальной установки Clang/LLVM.
make build-bpf
Использование Docker: Используйте этот вариант, если у вас нет необходимого набора инструментов для сборки на C. Он использует предварительно настроенный образ для разработки.
make build-bpf-via-docker
ptcpdumpПосле того как байт-код eBPF сгенерирован (или используются предварительно сгенерированные файлы), можно скомпилировать основное приложение на Go.
Статическая сборка (рекомендуется):
Этот вариант собирает ptcpdump со всеми его зависимостями,
включая встроенную версию libpcap (из подмодуля lib/libpcap),
статически слинкованную в финальный исполняемый файл.
В результате получается переносимый бинарный файл без внешних зависимостей от библиотек.
Это способ по умолчанию и рекомендуемый.
Нативная сборка: Эта команда сначала обеспечивает компиляцию встроенной libpcap,
а затем собирает статический исполняемый файл ptcpdump.
# Сначала собирается libpcap, затем ptcpdump статически
make build
Использование Docker: Собирает статический исполняемый файл внутри контейнера разработки.
make build-via-docker
Динамическая сборка:
Этот вариант собирает ptcpdump, динамически компонуя его с установленной в системе
библиотекой libpcap. Предварительно необходимо установить пакет разработки libpcap
(например, libpcap-dev в Debian/Ubuntu, в Fedora/CentOS).
В результате получается меньший исполняемый файл, но для работы на целевой системе
требуется наличие .
Финальный исполняемый файл будет создан в корневом каталоге проекта
(например, ./ptcpdump).
Flownix — это графический, работающий в реальном времени анализатор сетевого трафика на основе потоков для систем Linux. Он захватывает пакеты с помощью бинарного файла ptcpdump, извлекает детальные метаданные каждого потока, сохраняет их в SQLite и визуализирует всё в чистом и отзывчивом веб-интерфейсе Dash.
Репозиторий: VISION-183/flownix
--netns| Опция | Бэкенд | Примечание |
|---|
| CONFIG_BPF=y | оба | Требуется |
| CONFIG_BPF_SYSCALL=y | оба | Требуется |
| CONFIG_DEBUG_INFO=y | оба | Требуется |
| CONFIG_DEBUG_INFO_BTF=y | оба | Требуется |
| CONFIG_KPROBES=y | оба | Требуется |
| CONFIG_KPROBE_EVENTS=y | оба | Требуется |
| CONFIG_TRACEPOINTS=y | оба | Требуется |
| CONFIG_PERF_EVENTS=y | оба | Требуется |
| CONFIG_NET=y | оба | Требуется |
| CONFIG_NET_SCHED=y | tc | Требуется |
| CONFIG_NET_CLS_BPF=y | tc | Требуется |
| CONFIG_NET_ACT_BPF=y | tc | Требуется |
| CONFIG_NET_SCH_INGRESS=y | tc | Требуется |
| CONFIG_CGROUPS=y | cgroup-skb | Требуется |
| CONFIG_CGROUP_BPF=y | cgroup-skb | Требуется |
| CONFIG_FILTER=y | socket-filter | Требуется |
| CONFIG_BPF_TRAMPOLINE=y | tp-btf | Требуется |
| CONFIG_SECURITY=y | оба | Опционально (рекомендуется) |
| CONFIG_BPF_TRAMPOLINE=y | оба | Опционально (рекомендуется) |
| CONFIG_SOCK_CGROUP_DATA=y | оба | Опционально (рекомендуется) |
| CONFIG_BPF_JIT=y | оба | Опционально (рекомендуется) |
| CONFIG_CGROUP_BPF=y | tc, tp-btf, socket-filter | Опционально (рекомендуется) |
| CONFIG_CGROUPS=y | tc, tp-btf, socket-filter | Опционально (рекомендуется) |
Вы можете использовать zgrep $OPTION /proc/config.gz, чтобы проверить, включена ли опция.
tc | cgroup-skb | socket-filter | tp-btf |
|---|
| Тип программы eBPF | BPF_PROG_TYPE_SCHED_CLS | BPF_PROG_TYPE_CGROUP_SKB | BPF_PROG_TYPE_SOCKET_FILTER | BPF_PROG_TYPE_TRACING |
| Данные L2 | ✅ | ❌ | ✅ | ✅ |
| Межсетевое пространство имён | ❌ | ✅ | ❌ | ✅ |
| Версия ядра | 5.2+ | 5.2+ | 5.4+ | 5.5+ |
| cgroup v2 | Рекомендуется | Требуется | Рекомендуется | Рекомендуется |
--backend cgroup-skb:
$ sudo ptcpdump -i any --backend cgroup-skb host 1.1.1.1
12:11:28.009182 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [S], seq 615672474, win 64240, options [mss 146063 ecr 0,nop,wscale 7], length 0, Thread [curl.402475], ParentProc [bash.321004]
12:11:28.113815 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [S.], seq 1810787293, ack 615672475, win 64240, gth 0, ParentProc [bash.321004]
12:11:28.113849 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672475, ack 1810787294, win 64240, ash.321004]
12:11:28.114212 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [P.], seq 615672475:615672545, ack 1810787294, hread [curl.402475], ParentProc [bash.321004]
12:11:28.115409 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787294, ack 615672545, win 64240, lsh.321004]
12:11:28.534596 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [P.], seq 1810787294:1810787680, ack 615672545, ParentProc [bash.321004]
12:11:28.534738 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672545, ack 1810787680, win 63854, ash.321004]
12:11:28.536967 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [F.], seq 615672545, ack 1810787680, win 63854,.402475], ParentProc [bash.321004]
12:11:28.538189 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787680, ack 615672546, win 64239, lsh.321004]
12:11:28.642419 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672546, ack 1810787681, win 63854, ash.321004]
--backend socket-filter:
$ sudo ptcpdump -i any --backend socket-filter host 1.1.1.1
12:11:28.009426 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [S], seq 615672474, win 64240, options [mss 146063 ecr 0,nop,wscale 7], length 0, ParentProc [bash.321004]
12:11:28.113762 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [S.], seq 1810787293, ack 615672475, win 64240, gth 0, ParentProc [bash.321004]
12:11:28.113861 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672475, ack 1810787294, win 64240, ash.321004]
12:11:28.114503 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [P.], seq 615672475:615672545, ack 1810787294, arentProc [bash.321004]
12:11:28.115335 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787294, ack 615672545, win 64240, lsh.321004]
12:11:28.534424 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [P.], seq 1810787294:1810787680, ack 615672545, ParentProc [bash.321004]
12:11:28.534825 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672545, ack 1810787680, win 63854, ash.321004]
12:11:28.537088 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [F.], seq 615672545, ack 1810787680, win 63854,bash.321004]
12:11:28.538153 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787680, ack 615672546, win 64239, lsh.321004]
12:11:28.642247 ens33 curl.402475 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [FP.], seq 1810787680, ack 615672546, win 64239,bash.321004]
12:11:28.642537 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672546, ack 1810787681, win 63854, ash.321004]
--backend tp-btf:
$ sudo ptcpdump -i any --backend tp-btf host 1.1.1.112:11:28.009353 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [S], seq 615672474, win 64240, options [mss 146063 ecr 0,nop,wscale 7], length 0, ParentProc [bash.321004]
12:11:28.113739 ens33 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [S.], seq 1810787293, ack 615672475, win 64240, options [mss
12:11:28.113857 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672475, ack 1810787294, win 64240, ash.321004]
12:11:28.114225 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [P.], seq 615672475:615672545, ack 1810787294, arentProc [bash.321004]
12:11:28.115242 ens33 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787294, ack 615672545, win 64240, length 0
12:11:28.534245 ens33 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [P.], seq 1810787294:1810787680, ack 615672545, win 64240, l
12:11:28.534768 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672545, ack 1810787680, win 63854, ash.321004]
12:11:28.537038 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [F.], seq 615672545, ack 1810787680, win 63854,bash.321004]
12:11:28.538129 ens33 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [.], seq 1810787680, ack 615672546, win 64239, length 0
12:11:28.642088 ens33 In IP 1.1.1.1.80 > 10.0.2.15.48448: Flags [FP.], seq 1810787680, ack 615672546, win 64239, length 0
12:11:28.642523 ens33 curl.402475 Out IP 10.0.2.15.48448 > 1.1.1.1.80: Flags [.], seq 615672546, ack 1810787681, win 63854, ash.321004]
curl http://1.1.1.1 в docker-контейнере:--backend tc:
$ sudo ptcpdump -i any --backend tc host 1.1.1.1
12:20:31.336397 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.336533 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.336794 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0
12:20:31.468027 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0
12:20:31.467769 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.467781 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468025 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468042 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468061 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0
12:20:31.468089 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468093 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468110 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71
12:20:31.468464 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0
12:20:31.468535 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468558 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575461 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386
12:20:31.575576 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575613 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575877 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575890 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575916 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0
12:20:31.577079 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577107 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577146 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0
12:20:31.577736 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0
12:20:31.577761 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577773 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687029 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0
12:20:31.687166 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687214 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687398 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687413 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687453 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0
--backend cgroup-skb:
$ sudo ptcpdump -i any --backend cgroup-skb host 1.1.1.1
12:20:31.336108 45@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, Thread [curl.405939], ParentProc [bash.405653], Container [musing_banach]
12:20:31.467819 45@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.467876 45@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468072 45@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, Thread [curl.405939], ParentProc [bash.405653], Container [musing_banach]
12:20:31.468681 45@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575750 45@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575848 45@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.576982 45@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, Thread [curl.405939], ParentProc [bash.405653], Container [musing_banach]
12:20:31.577843 45@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687357 45@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
--backend socket-filter:
$ sudo ptcpdump -i any --backend socket-filter host 1.1.1.1
12:20:31.336456 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.336818 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0
12:20:31.467700 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0
12:20:31.467776 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.467784 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468030 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468066 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0
12:20:31.468092 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468122 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71
12:20:31.468461 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0
12:20:31.468552 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468565 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575416 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386
12:20:31.575601 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575623 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575889 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575928 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0
12:20:31.577085 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577153 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0
12:20:31.577733 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0
12:20:31.577770 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577778 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687015 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0
12:20:31.687206 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687223 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687409 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687464 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0
--backend tp-btf:
$ sudo ptcpdump -i any --backend tp-btf host 1.1.1.112:20:31.336316 eth0@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.336382 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.336443 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.336801 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [S], seq 3064539219, win 64240, options [mss 1460,sackOK,TS val 1731159046 ecr 0,nop,wscale 7], length 0
12:20:31.467682 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0
12:20:31.467773 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.467783 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.467811 eth0@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [S.], seq 488132001, ack 3064539220, win 64240, options [mss 1460], length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468005 eth0@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468022 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468029 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468063 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539220, ack 488132002, win 64240, length 0
12:20:31.468078 eth0@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468085 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468091 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468112 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [P.], seq 3064539220:3064539291, ack 488132002, win 64240, length 71
12:20:31.468446 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0
12:20:31.468543 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468562 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.468668 eth0@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132002, ack 3064539291, win 64240, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575358 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386
12:20:31.575586 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575617 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575732 eth0@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [P.], seq 488132002:488132388, ack 3064539291, win 64240, length 386, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575855 eth0@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575870 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575883 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.575920 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539291, ack 488132388, win 63854, length 0
12:20:31.577059 eth0@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577074 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577082 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577148 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [F.], seq 3064539291, ack 488132388, win 63854, length 0
12:20:31.577704 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0
12:20:31.577764 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577774 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.577835 eth0@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.686955 ens33 In IP 1.1.1.1.80 > 10.0.2.15.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0
12:20:31.687183 docker0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687218 veth1d387b0 curl.405939 Out IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687316 eth0@4026533097 curl.405939 In IP 1.1.1.1.80 > 172.17.0.4.38670: Flags [FP.], seq 488132388, ack 3064539292, win 64239, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687369 eth0@4026533097 curl.405939 Out IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687388 veth1d387b0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687404 docker0 curl.405939 In IP 172.17.0.4.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0, ParentProc [bash.405653], Container [musing_banach]
12:20:31.687457 ens33 Out IP 10.0.2.15.38670 > 1.1.1.1.80: Flags [.], seq 3064539292, ack 488132389, win 63854, length 0
libpcap-devellibpcap # Убедитесь, что пакет разработки libpcap установлен
# например, sudo apt-get install libpcap-dev
make build-dynamic-link