kernel-event-collector-module icon indicating copy to clipboard operation
kernel-event-collector-module copied to clipboard

PID wrap/reuse can cause network connections to be incorrectly de-duped

Open benhsmith opened this issue 5 years ago • 0 comments

The network tracking table (net-hooks.c) tracks network connection for a process, to dedup net-conn events.

The tracking table tracks the process only using the PID value & does not include start time. This means that if the PID were to be reused, the new process would match the existing entry and would be de-duped.

The solution would be adding the start-time to the network-tracking table.

benhsmith avatar Aug 06 '20 21:08 benhsmith