search

draios / sysdig

Linux system exploration and troubleshooting tool with first class support for containers
http://www.sysdig.com/
Other
7.78k stars 725 forks source link

Support monitoring wireguard events #1770

Open ciarand opened 3 years ago

ciarand commented 3 years ago

I have a wireguard network with two defined peers. I was hoping to use sysdig to examine the traffic (even if it's just "received X bytes from peer with address Y"). Unfortunately I haven't been able to get sysdig to do anything except ignore these connections. Tcpdump works as expected.

Here's what I tried (all examples running from the "server" that forwards incoming traffic from the remote "client" peer):

$ sysdig 'evt.is_io=true'
# (nothing relevant gets printed here)

On the other hand, tcpdump -i any 'src ${MY_PEER_IP}' does print the expected events. And because tcpdump produces I/O events you can see where sysdig is missing these packets:

$ sysdig 'evt.is_io=true'
15270 16:40:45.023115699 1 tcpdump (1503) < write res=89 data=16:40:44.952576 IP
example.com > ${MY_PEER_IP}53386: 27145 NXDomain 0/

Is this somehow related to sysdig not being able to monitor the in-kernel wireguard implementation? Is there a magic set of flags I can provide sysdig for it to be able to do the same thing tcpdump can?

ciarand commented 3 years ago

alternatively: is this supposed to work and I have just made some sort of mistake configuring my system that is preventing sysdig from doing its thing?

github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.