Skip to content

ospect/net: Filter network connections based on the process' open sockets on Linux.#224

Open
CRefice wants to merge 2 commits into
google:masterfrom
CRefice:filter_conn_by_pid
Open

ospect/net: Filter network connections based on the process' open sockets on Linux.#224
CRefice wants to merge 2 commits into
google:masterfrom
CRefice:filter_conn_by_pid

Conversation

@CRefice

@CRefice CRefice commented Jul 6, 2026

Copy link
Copy Markdown
Collaborator

The current implementation of ospect's network connection listing functionality on Linux tries to read a process' open connections from procfs, for instance from /proc/<pid>/net/tcp. However, /proc/<pid>/net/tcp is effectively the same as /proc/net/tcp, meaning it lists all open connections on the system, whether they were opened by the process in question or not. This results in incorrect process attribution, and even worse, in all_connections() returning multiple copies of the results, one per active process on the system!

To fix this, this PR introduces a similar strategy to that used by the python psutil package which was used by the old GRR agent: parsing the connection's inode from /proc/net/, and matching it with the process' currently open file descriptors (from /proc/<pid>/fd), ignoring the result if there's no match.

This can still result in some duplicate results being returned, since for example, a process can open a socket and then fork, in which case the connection will be considered as "owned" by both parent and child. But in the general case, this will no longer result in hundreds of thousands of duplicate results.

Overall, the public interface of net.rs is not well suited to Linux, where there is no 1:1 ownership between a process and a network connection. Having a standalone function to list connections owned by a given process means we must scan /proc/net/ once for each process, which is not ideal for performance.
Changing that would require more extensive changes to the implementation for other platforms as well, so we can save it for a future improvement.

@CRefice CRefice requested a review from panhania July 6, 2026 14:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants