Be the first to like this
Network monitoring of processes in Linux, using Linux dynamic Kernel instrumentation (KProbes)
Monitoring network interactions of one process accessing the network is not always simple and it has some performance issues.
A Linux Kernel Module was developed, which uses dynamic instrumentation and monitors the target user process for interactions and registers the information to a repository.
When packets pass through the network interface the repository is queried to decide if the packet should be captured for further analysis.
To control this monitoring mechanism an interface was developed which can be modified through files in the virtual filesystem, DebugFS.
To use this monitoring mechanism it is necessary to have the Linux Kernel Module loaded and have a user process running that performs the network monitoring (such as TCPDump). This monitoring process can use this mechanism without changing its own source code.