where is the action of delte tc filter #571

boost2020 · 2024-06-16T14:30:33Z

boost2020
Jun 16, 2024

There is a code with this annotation in file probe_openssl_pcap.go:

			// customize deleteed TC filter
			// tc filter del dev eth0 ingress
			// tc filter del dev eth0 egress
			// loopback devices are special, some tc probes should be skipped
			// TODO: detect loopback devices via aquasecrity/tracee/pkg/ebpf/probes/probe.go line 322
			// isNetIfaceLo := netIface.Flags&net.FlagLoopback == net.FlagLoopback
			//	if isNetIfaceLo && p.skipLoopback {
			//		return nil
			//	}

So the question I want to ask is, when using the PCAP module, will the original ingress/egress tc filter be deleted first, and then the tc filter will be regenerated

boost2020 · 2024-07-02T14:43:27Z

boost2020
Jul 2, 2024
Author

@cfc4n can you help me

3 replies

cfc4n Jul 2, 2024
Maintainer

Sorry, I forgot to reply. I‘ll have a look on the weekend. If you forget it, please remind me.

boost2020 Jul 8, 2024
Author

Could you take a look at this for me when you have a chance @cfc4n

cfc4n Jul 9, 2024
Maintainer

eCapture only clears the tc filters it creates itself; you can refer to https://github.com/gojue/ebpfmanager/blob/11525325c96c65722b2c2096fce73ba9122bb922/examples/clone_vs_add_hook/demo.go#L72

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

where is the action of delte tc filter #571

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

where is the action of delte tc filter #571

Uh oh!

boost2020 Jun 16, 2024

Replies: 1 comment · 3 replies

Uh oh!

boost2020 Jul 2, 2024 Author

Uh oh!

cfc4n Jul 2, 2024 Maintainer

Uh oh!

boost2020 Jul 8, 2024 Author

Uh oh!

cfc4n Jul 9, 2024 Maintainer

boost2020
Jun 16, 2024

Replies: 1 comment 3 replies

boost2020
Jul 2, 2024
Author

cfc4n Jul 2, 2024
Maintainer

boost2020 Jul 8, 2024
Author

cfc4n Jul 9, 2024
Maintainer