ospect/net: Filter network connections based on the process' open sockets on Linux.#224
Open
CRefice wants to merge 2 commits into
Open
ospect/net: Filter network connections based on the process' open sockets on Linux.#224CRefice wants to merge 2 commits into
CRefice wants to merge 2 commits into
Conversation
s-westphal
approved these changes
Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The current implementation of ospect's network connection listing functionality on Linux tries to read a process' open connections from procfs, for instance from
/proc/<pid>/net/tcp. However,/proc/<pid>/net/tcpis effectively the same as/proc/net/tcp, meaning it lists all open connections on the system, whether they were opened by the process in question or not. This results in incorrect process attribution, and even worse, inall_connections()returning multiple copies of the results, one per active process on the system!To fix this, this PR introduces a similar strategy to that used by the python
psutilpackage which was used by the old GRR agent: parsing the connection's inode from/proc/net/, and matching it with the process' currently open file descriptors (from/proc/<pid>/fd), ignoring the result if there's no match.This can still result in some duplicate results being returned, since for example, a process can open a socket and then fork, in which case the connection will be considered as "owned" by both parent and child. But in the general case, this will no longer result in hundreds of thousands of duplicate results.
Overall, the public interface of
net.rsis not well suited to Linux, where there is no 1:1 ownership between a process and a network connection. Having a standalone function to list connections owned by a given process means we must scan/proc/net/once for each process, which is not ideal for performance.Changing that would require more extensive changes to the implementation for other platforms as well, so we can save it for a future improvement.