retis-org / retis

Tracing packets in the Linux networking stack & friends
https://retis.readthedocs.io/en/stable/
100 stars 14 forks source link

Early tracking might be wrong #312

Closed atenart closed 9 months ago

atenart commented 11 months ago

Probes are installed sequentially and not in order. When matching packets while not all probes are installed, especially the ones required for the tracking infrastructure, we might have wrong tracking information as free events could be missed.

One easy way to see this is to install lots of probes (eg. -p skb*) while filtering on an IPv4 address. Before all probes are installed, if packets are matches, we might see unexpected events (here IPv6 or wrong address).

One solution might be to control the order in which those important probes are being installed.