search

kubeshark / tracer

The kernel tracer that attaches eBPF probes to containers for capturing TLS traffic
GNU General Public License v3.0
12 stars 6 forks source link

last N packets circular buffer: initial implementation #24

Closed iluxa closed 5 months ago

iluxa commented 5 months ago

For advanced tracer debug a new command line parameter is introduced:

  -cbuf int
        Keep last N packets in circular buffer 0 means disabled, max value is 10000

When it is not zero, tracer keeps last 0 < N <=10000 packets in memory and creates tls_last.pcap pipe in data directory Once reading this pipe is requested, tracer writes up to given N packets and closes the pipe

This functionality supposes to clarify https://github.com/kubeshark/tracer/issues/22