Capture connections from other container namespaces#132
Closed
Reaster0 wants to merge 1 commit into
Closed
Conversation
By default TapMap's psutil backend only sees the network namespace it
runs in, so connections inside other bridged Docker containers are
invisible even with `--network host --pid host`.
Add an opt-in backend (TAPMAP_CAPTURE_ALL_NETNS=1, Linux + pid:host)
that aggregates connections across every network namespace:
- delegates to PsutilNetInfo for the host namespace (unchanged process
attribution), then reads /proc/<pid>/net/{tcp,tcp6,udp,udp6} for each
other namespace discovered via /proc/<pid>/ns/net inodes
- skips the host namespace to avoid double counting
- parses hex IPv4/IPv6 (incl. IPv4-mapped) and TCP state codes into the
existing record shape, so geo-enrichment, the map, and open-ports work
unchanged
- labels rows by container: friendly names via a read-only mounted Docker
socket, falling back to docker:<short-id>, then netns:<inode>
- degrades to the host-only result on any scan error
Reports the active backend as "psutil+netns". Default-off; existing
behavior is preserved when the env var is unset.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Owner
|
I missed your PR. I've archived the proposal locally and opened issue #134. Thanks for the implementation, tests and documentation. |
Author
|
hi, sorry to have deleted the fork, i had a lot of never merged fork for a long time and i cleaned a lot of them, the tapmap was taken by the sweep haha |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
TapMap's psutil backend only reads the network namespace it runs in. Run as a Docker container with
--network host --pid host, it sees the host namespace (and host-network containers), but bridged containers' connections are invisible — each lives in its own netns.Change
New opt-in backend
NetNsNetInfo(TAPMAP_CAPTURE_ALL_NETNS=1, Linux +pid: host) that aggregates connections across every namespace:PsutilNetInfofor the host namespace (unchanged process attribution), then reads/proc/<pid>/net/{tcp,tcp6,udp,udp6}for each other namespace, discovered by grouping host PIDs by their/proc/<pid>/ns/netinode.docker:<short-id>, thennetns:<inode>.Backend reported as
psutil+netns.Usage
Testing
tests/test_netinfo_netns.py(19 tests): address/line parsing, IPv4-mapped demapping, state-code table,allowed_statusesfilter, cgroup→name labeling + fallbacks, graceful degradation. Full netinfo suite (22) green.🤖 Generated with Claude Code