-
Spike
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
-
None
-
False
-
-
False
-
None
-
None
-
None
-
None
See if we can include the running process that sends/receives traffic in net flows.
A use case that we've seen where it would help, is when application pods are using host network / interfaces, which makes traffic invisible from those pods (the traffic source is the node in that case). We've seen that with ODF, among others. Knowing the process could help reasoning about what's behind those host network flows.
Note: bpf_get_current_pid_tgid was added to TC in 6.10 kernel https://docs.ebpf.io/linux/helper-function/bpf_get_current_pid_tgid/ and backported in rhel 9.6
Also an upstream ask: https://github.com/orgs/netobserv/discussions/1769